I originally built this project about four years ago, then forgot about it. After rediscovering the repository, I decided to revisit it, finish what I started, and finally share it.

I first created it during the pandemic, when spin-the-wheel tools became popular for online team-building, virtual game nights with friends and family, and similar activities. Most of the available options were cluttered with ads and trackers, so I built a simpler alternative without either.

After refreshing the UI and updating the dependencies, the project is now complete.

You can try it here: Picksy

If you want to see the code or contribute, the project is available on GitHub: joiellantero/picksy

This release also gave me a chance to revisit an older idea and clean it up into something I would actually use today: lightweight, straightforward, and easy to share.

If you prefer working in the terminal, I also made a Python-based version here: name-roulette.

What is Phishing?​

As defined in Merriam Webster, Phishing is...

The practice of tricking Internet users into revealing personal or confidential information which can then be used illicitly.

Phishing can come through email, SMS, or phone calls, from fake princes offering wealth to urgent bank alerts or fraud department calls. These are common tactics used to steal your information. Let’s explore how to spot phishing in any form.

How to Recognize Phishing​

Phishing Emails​

Let's check out the email below. Spot anything interesting?

Credits to hooksecurity.co for the image.

Here's what to look out for:

• Design
• Address
• Subject and body
• Links

Does this look like a real Microsoft email? Probably not - no logo, and a sketchy domain like msupdate[.]net. Let’s drop it into VirusTotal, a free tool that scans links with multiple antivirus engines, and see what turns up.

Well, that looks bad...

So, VirusTotal flagged the domain as malicious - yep, definitely not from Microsoft. That’s a big clue this email’s up to no good.

Even if just a few antivirus engines catch it, like 3 out of 94, that’s enough to raise an eyebrow. A lot of phishing sites are brand new, so they might not get flagged right away. That’s why it helps to look at the whole email: check the subject, the wording, any weird typos or bad grammar, and see if the message feels off. Ask yourself: does this even make sense for me? Do I have a Microsoft account? And if you’re unsure, you can always right-click any links, copy them, and run them through VirusTotal. Better safe than sorry!

Smishing (Phishing through SMS)​

Here’s how Smishing plays out in real life: a text pretending to be from the Philippine Postal Corporation, the country’s official postal service, trying to trick the recipient.

The biggest red flag? The link. A legit government agency wouldn’t use a .com - it should be .gov.ph. Plus, there's a typo, and I’m not even expecting a package. Definitely a Smishing attempt.

Just because a domain ends in .gov.ph or belongs to a government agency doesn’t always mean it’s safe. What if their system gets hacked? As mentioned earlier, it’s important to look at the entire message and ask yourself the right questions before trusting it.

Vishing (Phishing through Voice Calls)​

Vishing scams can catch you off guard, but staying safe is all about being cautious. If you get a call from someone you don’t know, especially if they’re asking for personal info or making things sound urgent, like “your account is locked” or “you’re under investigation,” take a step back. Don’t panic. Just hang up, and call the company or agency yourself using their official number. It’s always better to double-check than get tricked.

Protect Yourself Going Forward​

Phishing comes in many forms, but the goal is always the same: to trick you into handing over something valuable. The good news? A little awareness goes a long way. By staying curious, double-checking messages, and using tools like VirusTotal, you’re already making it harder for attackers to succeed. Keep your guard up, trust your instincts, and remember: it’s okay to pause before you click, tap, or respond. That moment of caution could save you a lot more than just your inbox.

OSINTs​

Useful tools for IOC-based and community-backed detections.

• Virustotal - URL, file, domain, IP, hash
• Cisco Talos - domain, IP, email, sha256
• Abuse IPDB - IP
• Censys - hosts, certificates
• IBM X-Force - URL, IP, domain, email, cve, cidr, hash, mutex, yara
• Open Threat - URL, IP, domain, email, cve, cidr, hash, mutex, yara
• Domain Tools - check domain info
• Threat Miner - IP, domain, hash, email, ssl cert, file, registry, mutex expired domain
• Threat Crowd
• Sherlock - Social media OSINT

Sandbox​

Useful tools to check suspicious website or detonate malicious files.

• Browserling - Interact with websites
• Hybrid Analysis - Malware file sandboxing

Phishing Analysis​

Useful tools to aid when performing phishing analysis

• Google Admin Toolbox - Email header analyzer
• PhishTank - A public threat feed that provides intelligence regarding phishing attacks and malicious artifacts
• DNS Twist - A phishing domain scanner
• PunyCoder - A tool to check for homographs
• Wannabrowser - A tool to check the destination URL of shortened URLs
• DNS Reverse Lookup - Useful to reverse DNS the x-sender-ip
• PhishTool - Easier way to gather email artifacts

Data Manipulation​

Useful tool to encode, decode, hash, encrypt, decrypt, and more.

• CyberChef

MITRE ATT&CK Framework​

• Attack Navigator platform

Security Vendor Threat Blogs​

• CrowdStrike
• RiskIQ Articles
• PaloAlto's Unit42
• Cisco Talos
• Intel471
• digital_shadows
• ThreatConnect Blog
• DomainTools Blog

Remove the hiding animation​

Here are four steps to remove your macOS dock hiding animation.

1. Right click on your macOS dock and click "Turn Hiding On". No need to do this step if you have it already turned on.

2. Open your terminal.

   1. command + space
   2. Type terminal then press enter.

3. Run the command below to remove the delay to show up and the animation itself.

   defaults write com.apple.dock autohide-delay -float 0; defaults write com.apple.dock autohide-time-modifier -int 0; killall Dock
   

4. Test it out.

Customize the animation​

If you want to keep the animation but remove the delay, run the command below.

defaults write com.apple.dock autohide-delay -float 0; killall Dock

If you only want to modify the timing of the animation, change the number of seconds next to -float to your liking.

defaults write com.apple.dock autohide-time-modifier -float 0.25; killall Dock

Back to the original​

To restore the default settings fo the hiding animation, run the command below.

defaults delete com.apple.dock autohide-delay; killall Dock

The Application Services framework provides essential APIs for tasks like graphics rendering, image handling, accessibility, and more. Using the Core Graphics component, I can build a program to automatically move the mouse pointer to random locations on the screen.

The first step is to create the main() function, where we’ll initialize the random number generator. By default, the generator produces the same sequence each time the program runs. To make it truly random, we’ll seed it with a unique value using the time() function, as the system time changes with every program execution.

int main() {
    // initialize starting point of random number generator
    srand((unsigned int)time(NULL));

    while (1) {
        int randomNumber = rand();
        printf("Random Number: %d\n", randomNumber);
        // generate a random number every 3 seconds
        sleep(3);
    }
    return 0;
}

The output of the program above should be something like this:

$ ./test
Random Number: 1307726537
Random Number: 1612263961
Random Number: 371734681

The next step is to create the jiggleMouse() function. Imagine that the Quandrants of the Coordinate Plane is on top of your screen. The function's purpose is to obtain the current x and y coordinates of the mouse pointer and add the random numbers generated earlier. With this, the new mouse pointer location will move along the x and y axis of the screen. It's also important to note that we need to release the memory used by our program using CFRelease() once we are done with the process. See the completed function below.

void jiggleMouse() {
    // get the current mouse position
    CGEventRef event = CGEventCreate(NULL);
    CGPoint currentPos = CGEventGetLocation(event);
    CFRelease(event);

    // generate random movement values
    int deltaX = (rand() % 21) - 10; // Random value between -10 and 10
    int deltaY = (rand() % 21) - 10; // Random value between -10 and 10

    // move the mouse to a new position
    CGPoint newPos = CGPointMake(currentPos.x + deltaX, currentPos.y + deltaY);
    CGEventRef move = CGEventCreateMouseEvent(NULL, kCGEventMouseMoved, newPos, kCGMouseButtonLeft);
    CGEventPost(kCGHIDEventTap, move);
    CFRelease(move);

    printf("Mouse moved to: (%.0f, %.0f)\n", newPos.x, newPos.y);
}

Before running the program, change sleep(3); to sleep(60); so that the mouse will not move too often. This will move the mouse every 60 seconds. You can also change this to your own preference. Afterwards, run the program and it should show similar outputs below.

$ ./mouse_jiggler
Mouse moved to: (959, 569)
Mouse moved to: (956, 571)

Note that the output coordinates shown in my example above will be different with your's.

This guide walks through a practical way to check whether a link is likely safe before you visit it. You do not need paid tools or deep security experience. You only need a careful process and a few reputable resources.

According to Proofpoint's 2024 State of the Phish report, risky user behavior is still a major factor in phishing success. That matters because one careless click can lead to credential theft, malware, or account compromise.

If you remember only one thing from this article, remember this: if a link feels off, do not open it directly. Check it first.

Why malicious links are dangerous​

A malicious link can do more than take you to a sketchy webpage. It can:

1. Send you to a fake login page that steals your password
2. Trigger a malware download
3. Redirect you through several domains to hide the final destination
4. Abuse trust by impersonating a bank, coworker, online store, or cloud service

That is why the safest habit is to inspect first and click later.

If you also want to get better at spotting phishing messages in general, Proofpoint has a useful article on how to recognize phishing emails.

Before you use any tool​

Start with these basic habits:

1. Do not click the link just to see where it goes
2. Copy the link address instead of opening it
3. If possible, inspect the full URL for misspellings, extra words, or strange subdomains
4. Be more cautious if the message creates urgency such as "verify now" or "your account will be locked"

Even a quick visual check can reveal obvious problems like fake domains, random strings, or misleading lookalike brands.

Step 1: Scan the link with a trusted online tool​

One of the easiest ways to investigate a suspicious link is to scan it with an online reputation tool such as VirusTotal.

Follow this process:

1. Right-click the suspicious link and copy the URL
2. Open VirusTotal
3. Paste the URL into the search box
4. Submit it and wait for the scan results
5. Review the detection count, domain information, and any community feedback

How to interpret the results​

The scan result is useful, but it is not the whole story.

Use this rule of thumb:

1. If the detection count is 0, the link may be low risk, but that does not guarantee it is safe
2. If several vendors detect it, treat it as suspicious or malicious
3. If only one or two vendors flag it, pause and gather more context before deciding

Step 2: Verify with more than one source​

Do not rely on a single service if the situation matters. Cross-checking helps reduce false positives and false negatives.

You can compare results using other tools and references such as the resources listed in List of Free Cybersecurity Tools and Resources.

As a simple decision guide:

1. If multiple reputable tools show no detections, the risk is lower
2. If multiple tools flag the same URL or domain, treat it as unsafe
3. If the results are mixed, do not assume it is safe just because most tools are quiet

Mixed results usually mean you need more context.

Step 3: Investigate deeper when the result is unclear​

Sometimes a link gets a low detection count like 1 or 2. That does not automatically mean it is harmless or dangerous. It means you need to look closer.

Look at the domain carefully​

Ask yourself:

1. Is the domain spelled correctly?
2. Is it pretending to be a known brand?
3. Does it use odd subdomains like brand-login-security.example.com?
4. Does the URL contain random strings, urgent words, or suspicious file names?

Check the community feedback​

VirusTotal also includes a Community tab where users may leave comments about a domain or URL.

This can help you answer questions like:

1. Has this domain been reported for phishing or abuse before?
2. Is it a tracking or ad-tech domain rather than a direct malware host?
3. Are other analysts warning people not to trust it?

To check it:

1. Open the result page in VirusTotal
2. Click the Community tab
3. Read the comments carefully and treat them as supporting context, not absolute proof

In the example above, the scan result is clean, but the community discussion suggests that dtscout[.]com is used for tracking and analytics. That does not automatically make it malware, but it does change how you should think about the domain. A clean detection score does not always mean a domain is trustworthy or appropriate to allow.

A practical way to make a decision​

Here is a simple approach you can use in real situations:

1. If the link is clearly malicious, block or report it
2. If the link is suspicious and the purpose is unclear, do not open it
3. If the link appears clean but still feels unnecessary or untrusted, avoid it anyway
4. If you are checking a work-related link, ask your IT or security team before visiting it

This last point matters. In many cases, the best decision is not to prove a link is safe. It is to decide that you do not need to click it.

Quick checklist​

Before opening any unfamiliar link, run through this checklist:

1. Copy the URL instead of clicking it
2. Scan it with VirusTotal
3. Check at least one or two additional sources
4. Look closely at the domain name and structure
5. Read any community comments or reputation notes
6. If anything still feels off, do not open it

Final thoughts​

Checking suspicious links is a useful skill because most attacks do not look dramatic. They look ordinary. A fake sign-in page, a shipping notification, or a document share link can be enough to trick someone who is moving too fast.

The goal is not to become perfect. The goal is to slow down, verify what you can, and avoid giving attackers an easy win.

What is Azure Key Vault?​

Azure Key Vault is a cloud service for securely storing and accessing secrets. We can store API keys, passwords, certificates, or cryptographic keys. Access to these resources are also configurable as we can setup the firewall specific for our Key Vault or setup a private endpoint.

Create an Azure Key Vault​

For those who don't have a Key Vault, you can create one in your resource group using the command below.

keyvault_name=<mykeyvault>
az keyvault create \
    --resource-group myResourceGroupSecureWeb \
    --name $keyvault_name \
    --enabled-for-deployment

Generating a certificate in Key Vault​

In this section, we generate a self-signed certificate but, in production, import your own certificate signed by a trusted provider.

az keyvault certificate create \
    --vault-name $keyvault_name \
    --name $cert_name \
    --policy "$(az keyvault certificate get-default-policy)"

Storing a certificate in Key Vault​

If you have your own certificate, you can import it using the command below.

az keyvault certificate import \ 
    --vault-name "<your-key-vault-name>" \
    -n "ExampleCertificate"\ 
    -f "/path/to/ExampleCertificate.pem"

Transfering the certificate from Key Vault to VM​

Once you create or import a certificate in Azure KeyVault, run the following commands below to import the certificate and private key in our VM. Update or replace the variable below with the appropriate details.

First, we obtain the certificate ID by running az keyvault secret list-versions.

secret=$(az keyvault secret list-versions \
          --vault-name $keyvault_name \
          --name $cert_name \
          --query "[?attributes.enabled].id" --output tsv)

Next, we need to convert the ID into something our VM can use.

vm_secret=$(az vm secret format --secret "$secret")

Finally, we update our VM's OSProfile secret value.

az vm update -n $vm_name -g $rg_name --set osProfile.secrets="$vm_secret"

With this, we now successfully transferred the certificate in our VM.

Using the certificate​

SSH into our VM and follow the steps below to use the SSL certificate for our site.

1. Upon running the commands, the certificate and private key will be stored in /var/lib/waagent. The filename will be the thumbprints as seen in Azure Key Vault.

2. Duplicate the .crt and .prv and rename it into something more readable. For instance, you can run something similar to the following commands:

   cat <key_thumbprint_here>.crt > mysite.crt
   cat <key_thumbprint_here>.prv > mysite.prv 
   

3. Move these to /etc/nginx/certs/.

   mv mysite.crt /etc/nginx/certs/ 
   mv mysite.prv /etc/nginx/certs
   

4. Update Nginx config file

   server {
        ...
        listen 80;
        server_name mysite.com 12.345.67.8; 
        listen 443 default_server ssl;
        ssl_certificate /etc/nginx/certs/mysite.crt;
        ssl_certificate_key /etc/nginx/certs/mysite.prv;
        ...
    }
   

5. Restart Nginx: sudo systemctl restart nginx.

6. Visit your site and check if you have the lock icon beside the URL.

osProfile Issue​

Below is an alternative way of importing your SSL cert to your VM.

1. Prepare your cert and key

This ensures that the .pfx file is in binary format (done by adding the flag --encoding base64).

# download your cert from Azure Key Vault and copy the file in your VM 
# if you already have your cert.pfx in your local machine, skip this step
az keyvault secret download --file <certname>.pfx --vault-name <keyvaultname> --name <certname> --encoding base64

openssl pkcs12 -in <certname>.pfx -nocerts -out <certname>.key -nodes -passin pass:
openssl pkcs12 -in <certname>.pfx -clcerts -nokeys -out <certname>.crt

2. Once you have your cert and key ready, you can copy them using scp command.

scp cert.crt cert.key <vmuser>@<vmip>:~

# if you specified a port
scp -P 1234 cert.crt cert.key <vmuser>@<vmip>:~

This will save the files in the home directory: cd ~

3. Create a new Nginx certs folder: mkdir /etc/nginx/certs/
4. Move the files into the Nginx certs folder:
   • Run command: mv <certame>.crt /etc/nginx/certs/
   • Run command: mv <certname>.prv /etc/nginx/certs/
5. Update Nginx config file: sudo vim /etc/nginx/sites-available/ctfd
6. Restart Nginx
   • Run command: sudo systemctl restart nginx
7. Visit your site at https://<sitedomain>.com/

Final Thoughts​

Using the Azure Key Vault is quite easy but it may be overwhelming as Microsoft has a lot of documentations for their cloud services. This article makes it easy to follow to do a simple thing such as making your site more secure with an SSL certificate.

What the course covers​

SANS GPCS dives into cloud security across the three major cloud service providers--AWS, Azure, and Google Cloud. The course covers how to uncover cloud vulnerabilities and unintentional exposure caused by improper configurations in IAM, networking, and storage services. It also discusses best practices you can tailor to your organization's needs.

The content was well-researched and struck a great balance between theory and hands-on application. As someone working in threat detection, I found it incredibly valuable to see cloud risks from a defender's perspective--understanding how misconfigurations happen and what attackers look for. I was able to take these insights back to work and develop strategies for strengthening our cloud security posture.

The in-person experience​

Attending in person was worth it. I connected and networked with cybersecurity professionals from around the world--my instructor, classmates, and the SANS staff. The course also included live-online participants, and all class discussions were recorded for future reference.

Our instructor was Brandon Evans, one of the course authors, who signed our GPCS posters. I also collected a haul of SANS freebies: a 2023 shirt, stickers, pens, a highlighter, and a notebook. At a community night event, I picked up even more--a 2020 shirt, additional stickers, and a SANS poker chip. Freebies depend on extra stock, and these events are held globally.

The Netwars challenge​

My favorite part of the course was the hands-on component. SANS runs Netwars, their own capture-the-flag competition, where you get to apply everything you've learned in real-world scenarios. It pushed me beyond the course material and got me exploring additional technologies like Terraform.

You're awarded a coin if you meet the instructor's criteria for the challenge. In our case, it was finishing in the top 3--and I'm proud to say I made it to the top spot!

Preparing for the exam​

Balancing exam prep with a full-time job was the hardest part. My exam voucher was valid for around four months, and I had grand plans to study gradually over that entire period. That didn't happen. In reality, I only managed to focus on studying during the final month before my exam.

I reviewed the learning materials by rewatching the recorded lectures and highlighting key information in the books. SANS also provides an audiobook, which I tried listening to while driving--but the chaotic metro traffic made that experiment short-lived.

Building my index​

Here's the thing about SANS exams: they're open-book. You can bring an armful of hard-copy books, notes, and printed materials into the exam room. No digital copies or devices though--phones and tablets are not allowed.

This open-book policy meant I could focus on understanding concepts rather than memorizing them. The key was having a well-organized index so I could quickly find any topic during the exam. I used the "Pancakes Indexing System" which I learned from Lesley Carhart's blog post--highly recommended.

Practice tests​

The course included two practice tests, and I took them after building my index. The practice test platform is designed to be similar to the actual exam environment.

After my first practice test, I noted down every topic I struggled with, then went back to review those areas and added more detail to my index. This feedback loop worked well--my second practice test score was noticeably higher. If you're scoring between 75-85% on the practice tests, that's a good sign you're ready. The passing score for GPCS is 64%.

The actual exam​

I took the exam just days before my voucher expired--talk about cutting it close. I was genuinely nervous. This was my first intermediate-to-advanced security certification, and despite the company sponsoring it, the cost made the stakes feel even higher.

Luckily, I passed. And as a cherry on top, I was invited to join the GIAC Advisory Board--an honor extended to those who score above 90%. It's a mailing list community that requires signing an NDA to join.

Final thoughts​

SANS GPCS is a significant financial investment, which is why company sponsorship is usually the way to go. But the return on that investment is real--the knowledge I gained was immediately applicable at work, and using those concepts to improve our cloud security actually generated cost savings that can pay for the course itself.

If you're a cloud security practitioner looking for a structured, vendor-neutral deep dive into securing AWS, Azure, and GCP, I'd highly recommend this course. Just don't wait until the last month to start studying like I did.

This article covers how we can deploy an open-source CTF platform in the cloud.

The CTF platform​

There's an open-source CTF platform which you can fork/clone the code in GitHub. It's free but it has a paid version if you don't want to host the site.

Setting up the basic configuration of the site​

I created a virtual machine (VM) in my Azure resource group and below are the specifications.

VM Specifications:

• OS: Ubuntu 20.04
• Storage: 30GB
• 2GB RAM
• 2 vCPU

After provisioning the VM, SSH into it and run the following commands. Also make sure that the ports for HTTP and HTTPS are allowed in your network security group.

# configure user for our CTFd resources
sudo adduser ctfd

# add the user to the sudo group
sudo usermod -aG sudo ctfd

# add the necessary firewalls
sudo ufw allow openssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

# update and install required software
sudo apt update
sudo apt upgrade -y
sudo apt install -y python3-pip python3-dev build-essential libssl-dev libffi-dev python3-setuptools nginx git
pip3 install pipenv

# install CTFd
cd /var/www
sudo git clone https://github.com/CTFd/CTFd.git

# switch into the ctfd user
su ctfd
sudo chown -R ctfd:www-data /var/www/CTFd
cd /var/www/CTFd

# Create a pipenv to run CTFd in
pipenv install --python 3.12
pipenv shell
./prepare.sh

Testing the site​

sudo ufw allow 5000
gunicorn --bind 0.0.0.0:5000 'CTFd:create_app()'

# try to access the website
http://<ip_address_here>:5000 or
http://<domain_here>:5000 

Further configuring the CTFd site​

In this section, we will edit the systemd service unit file to install the workser service and other processes for the site. For deploying the site in single-core CPUs, we will use three workers with worker-class=gevent and set keep-alive=2.

# identify the pipenv virtual environment for use in unit file
pipenv --venv
/home/ctfd/.local/share/virtualenvs/CTFd-rOJbThUf

# Create service unit configuration
sudo vim /etc/systemd/system/ctfd.service

# Copy all below (lines 5-17) and paste it in ctfd.service
[Unit]
Description=Gunicorn instance to serve ctfd
After=network.target

[Service]
User=ctfd
Group=www-data
WorkingDirectory=/var/www/CTFd
Environment="PATH=/home/ctfd/.local/share/virtualenvs/CTFd-rOJbThUf/bin"
ExecStart=/home/ctfd/.local/share/virtualenvs/CTFd-rOJbThUf/bin/gunicorn --bind unix:app.sock --keep-alive 2 --workers 3 --worker-class gevent 'CTFd:create_app()' --access-logfile '/var/log/CTFd/CTFd/logs/access.log' --error-logfile '/var/log/CTFd/CTFd/logs/error.log'

[Install]
WantedBy=multi-user.target

Setting up Nginx​

Create log directories​

sudo mkdir -p /var/log/CTFd/CTFd/logs/
sudo chown -R ctfd:www-data /var/log/CTFd/CTFd/logs/

Create Nginx site​

sudo systemctl enable ctfd
sudo systemctl start ctfd
sudo systemctl status ctfd

Create Nginx site​

# let's encrypt will handle the https later
sudo vim /etc/nginx/sites-available/ctfd

# Nginx config (copy lines 6-15)
# the client_max_body_size enables file uploads over the default of 1MB
server {
    listen 80;
    server_name <your_domain_here> <your_ip_address_here>;
    client_max_body_size 75M;
    location / {
        include proxy_params;
        proxy_pass http://unix:/var/www/CTFd/app.sock;

    }
}

# Link config file
sudo ln -s /etc/nginx/sites-available/ctfd /etc/nginx/sites-enabled

# Remove defaults
sudo rm /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default

# Test nginx configuration
sudo nginx -t

# Restart nginx if test wasw good
sudo systemctl restart nginx

Configuring the site for better security​

It's important to secure our website to avoid compromising the confidentiality, integrity, and availability of our site. What's more is cloud service providers are often vulnerable by default and it's our job, as customers, to configure the cloud to fit our needs.

In this section, we discuss some configurions we can do to make our CTFd site more secure.

Adding an SSL certificate​

A simple and free way to add an SSL certificate for your site is by using certbot. Visit the certbot website and follow the instructions for installation. Note that you must make sure to select the corresponding OS and web server.

Changing the SSH Port​

Below is the process of changing the SSH port. For instance, changing it from port 22 to port 1234. Make sure that the port you will use is available.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_backup
sudo vim /etc/ssh/sshd_config

# uncomment "#Port 22" and change the port number
# example:
Port 1234

# update the firewall
sudo ufw allow 1234

# delete OpenSSH
sudo ufw status numbered
sudo ufw delete <enter_here_the_number_of_OpenSSH>

In Azure, update the NSG inbound rules to allow the port you chose. In the example above, it's port 1234. Remove the SSH port 22 inbound rule as well.

Configuring the CTFd platform as an internal site​

If you don't want to expose your site to the public internet, remove the public IP and use the private IP as point of access to the site. You may also want to register a domain and configure its DNS record to point to the private IP.

Steps:

1. After removing the public IP, update the IP address in Nginx.

# let's encrypt will handle the https later
sudo vim /etc/nginx/sites-available/ctfd

# Nginx config (copy lines 6-15)
# the client_max_body_size enables file uploads over the default of 1MB
server {
    listen 80;
    server_name <your_domain_here> <your_ip_address_here>;
    client_max_body_size 75M;
    location / {
        include proxy_params;
        proxy_pass http://unix:/var/www/CTFd/app.sock;

    }
}

2. Restart Nginx and test the site.

3. In Azure, configure a virtual network (VNET) that is setup for internal sites or apps and use that VNET for your CTFd server.

4. Final step is to change your NSG inbound rules and set them to receive sources from your VNET.

Theme Configuration​

1. I will use the Pixio theme as an example (Theme Repository)

2. Clone the repository in the CTFd theme folder by running the command

   git https://github.com/hmrserver/CTFd-theme-pixo /var/www/CTFd/CTFd/themes/
   

3. Login as admin and change the theme in the config page.

4. You may also customize the theme header. For instance,

   <style id="theme-color">
    :root {--theme-color: #17377f;}
    .navbar{background-color: var(--theme-color) !important;}
    .jumbotron{background-color: var(--theme-color) !important;}
    .modal-content{background-color: #0E204B !important;}
    .challenge-button{box-shadow: 3px 3px #004CFF !important}
   </style>
   

5. You may also customize the footer content. For instance,

   <script>
    document.querySelector("footer a").innerText = "Powered by MyOrg";
    document
      .querySelector("footer a")
      .setAttribute("href", "https://myorg.com");
   </script>
   

Configuring the flicker effect of Pixio theme​

I noticed that the flicker effect of this particular theme may be unpleasant for some. To remove the flicker, simply follow the steps below.

1. cd /var/www/CTFd

2. go to CTFd/themes/pixo/static/css

3. do sudo vi main.min.css

4. find @keyframes flicker

5. delete everything in it except the 0% and 100%

6. change the parameter of 0% and 100% to "opacity" to ".5"

   @keyframes flicker{
     0% {
       opacity: 0.5;
     },
     100% {
       opacity: 0.5;
     }
   }
   

Getting Started​

In your project, install Recoil using the npm command below.

npm install recoil

or if you're using yarn.

yarn add recoil

You can view more installation guides in the documentation here.

Next, we need to add Recoil to our index.js so that we can use it everywhere in our project.

...
import { RecoilRoot } from "recoil";

ReactDOM.render(
  ...
    <RecoilRoot>
        <AppRoutes />
    </RecoilRoot>
  ...
  document.getElementById('root')
);

Creating an atom​

Atoms contain the source of truth for our application state and below is an example of creating an atom.

export const darkModeState = atom({
  key: 'darkMode',
  default: false,
});

For use cases like this, I like to put my atoms inside a globalState.js file inside the shared folder of my project. This is because many components will share this atom. Moreover, inside the atom that I made is a unique key and a default value. An atom key is a serializable value that labels the atom and it's useful especially when we want to persist our state. On the other hand, the default value is the default state of the atom.

Using the atom in your component is almost similar to useState hooks.

const [isDarkModeEnabled, setIsDarkModeEnabled] = useRecoilState(darkModeState);

Instead of useState, we use useRecoilState and instead of passing the default state, e.g., false, we pass in our atom, i.e., darkModeState.

When we don't need to change the state of the atom and only need access to its value, we can simply do it like the code snippet below.

const isDarkModeEnabled = useRecoilValue(darkModeState);

Saving the state to local storage​

There are use cases when we want to keep states like saving the preferred theme to the website visitor's browser local storage. This helps returning visitors to keep their preferred settings that they set on their previous visit.

Below is an example of using Recoil to persist the theme of a website.

const localPersist = ({onSet, setSelf, node}) => {
  const storedData = localStorage.getItem(node.key)
  if (storedData != null){
    setSelf(JSON.parse(storedData))
  }
  onSet((newData, __, isReset) => {
    isReset
      ? localStorage.removeItem(node.key)
      : localStorage.setItem(node.key, JSON.stringify(newData));
  })
}

export const darkModeState = atom({
  key: 'darkMode',
  default: false,
  effects: [localPersist]
});

Notice the effects parameter that I added to my atom. That parameter is called atom effects and it's an API for managing side-effects and synchronizing or initializing Recoil atoms. It's typically used in state persistence, synchronization, managing history, etc. As seen above, I passed the function that handles saving, removing, and getting the state from the browser's local storage

Furthermore, the localPersist function can be called by any atom. In other words, if you need a state to persist, you can just call the function to persist your state. Besides boolean values, the function also works for other data types like strings, objects, and arrays.

export const myStringState = atom({
  key: 'myString',
  default: '',
  effects: [localPersist]
});

export const myListState = atom({
  key: 'myList',
  default: [],
  effects: [localPersist]
});

Inside the localPersist function we have the onSet function which gets called when our atom changes. To get the state from our local storage, we use the setSelf function. Moreover, the isReset function is used when the useResetRecoilState is called which removes the state from the browser's local storage.

Now that we've finished setting up the globalState.js, we now have states that are accessible to multiple components which also persists. You can check if it works by going to inspect element > Application tab > Storage > Local Storage > http://your-website-url.

Final Thoughts​

Recoil is easy to implement and as seen earlier, it's similar to how we use useState. There are many new state management libraries currently existing and maybe more will be released. Jotai is an example of a state management library that is similar to Recoil–they are both atomic. Other types of libraries are flux (Redux, Zustand) and proxy (Mobs, Valtio, Overmind). At the end of the day, choosing the right library for your project depends on many variables like package size, use case, and more.

I created a program that a user can run in their terminal using Python and it can read a list of names from either a comma-separated-value (.csv) file or a text (.txt) file.

Giving the program settings some flexibility​

I wanted the program to take in arguments and command-line options so that I can easily adjust the settings to my liking. I used Python's argument parser library, argparse, for this. I created two positional arguments that takes in a file and integer value. The file should contain the list of names whereas the integer is the number of people to be chosen randomly.

parser = argparse.ArgumentParser(description='Name Roulette. A random picker for names.')

parser.add_argument(
    'file',
    metavar='filename',
    type=str,
    help='Files accepted are csv and txt files. Add the filename of the text or csv file containing the names as an argument, e.g., fileName.csv. Each name should be entered in a new line. You may refer to the README.md to see more examples.'
)

parser.add_argument(
    'amount',
    metavar='amount',
    nargs='?',
    default=1,
    type=int,
    help='The number of people to be chosen randomly.'
)

Next, I also wanted to have optional arguments for removing the name after it was chosen, displaying the list of names, and cowsay.

parser.add_argument(
    '--repeat',
    action="store_true",
    required=False,
    help='Loop through the names of the players forever. Not including the --repeat flag will remove the player from the list once they are chosen.'
)

parser.add_argument(
    '--display',
    action="store_true",
    required=False,
    help='Show the list of names.'
)

parser.add_argument(
    '--cowsay',
    action="store_true",
    required=False,
    help='Show chosen name/s with cowsay illustration.'
)

When the --repeat flag is specified by the user, it should choose random names from the list without removing them. On the other hand, when it's not specified, the program will remove the name from the list after it is chosen.

File handling​

The first thing that my program does is to read the filenames check if it exists. I also added error handling to make sure that the user remembers to put the file type, i.e., if it's a .csv or .txt file. I used Python's pandas library to obtain the names from the .csv or .txt file. Note that the program doesn't edit the input file instead, it saves a copy of the names. This is related to the –repeat flag because not indicating the said flag would remove the name from the list.

def get_names(filename):
    try:
        names_df = pd.read_csv(filename, sep=",", header=None, names=["Names"])
        names_df['Names'] = names_df['Names'].astype('string')
        return names_df
    except FileNotFoundError:
        print(f"\nFile '{filename}' does not exist.")
        if filename[-4:] != '.csv' and filename[-4:] != '.txt':
            print(f"Please include file type, e.g., {filename}.txt or {filename}.csv.")
        sys.exit(0)

Randomly choosing a name​

Now that I have the list of names ready, we can now proceed to creating the function to pick a random name. This function should take in all the positional and optional arguments. I again used pandas to pick a random name from the list and to also remove the name from the list.

def draw_name(df, amount, repeat, display, acowsay):
    while not df.empty:
        chosen_name = []
        for i in range(0, amount):
            if df.empty:
                break
            chosen_name.append(df.loc[df.sample().index[0], 'Names'])
            if not repeat:
                df = df[df["Names"].str.contains(chosen_name[i])==False]
        if display and not df.empty:
            print(df)
        if acowsay:
            cowsay.tux(', '.join(chosen_name))
        else:
            print(f"\nChosen Name/s: {', '.join(chosen_name)}")
    else:
        print("\nProgram Ended.\nList of names is now empty.")
        sys.exit(0)

The user should also have an option to pick another name or not. Thus, I created another function called ask_choose_again() to do this task. I then called this function at the end of the while loop in the draw_name() function.

def ask_choose_again():
    again = input("\nChoose again? [Y/N]: ")
    if (again == 'y' or again == 'Y'):
        return
    elif again == 'n' or again == 'N':
        print("\nProgram ended.")
        sys.exit(0)
    else:
        print("\nInvalid input: type Y for yes or N for no.")
        ask_choose_again()

Improving the user experience​

To give some aesthetics to my program, I added a loading animation to simulate that the program is picking a name–kind of like a drum roll. Note that the loading time is fake and it doesn't really depict the true speed of the program when choosing a name from a list because doing that would be very quick to even see the animation. In my program, I set the loading animation to show up for one-second but you can easily change it by adjusting the value in the time.sleep(x).

def loading_animation():
    done = False
    def animate():
        for c in itertools.cycle(['|', '/', '-', '\\']):
            if done:
                break
            sys.stdout.write('\rchoosing someone... ' + c)
            sys.stdout.flush()
            time.sleep(0.1)
    t = threading.Thread(target=animate)
    t.start()
    time.sleep(1)
    done = True

I also added a clear screen function to clean up the terminal every time we pick a random name.

def clear_terminal():
    os.system('cls' if os.name == 'nt' else 'clear')

Finally, I added the loading_animation() and clear_terminal() function calls to my draw_name() function.

def draw_name(df, amount, repeat, display, acowsay):
    while not df.empty:
        clear_terminal()
        loading_animation()
        clear_terminal()
        chosen_name = []
        for i in range(0, amount):
            if df.empty:
                break
            chosen_name.append(df.loc[df.sample().index[0], 'Names'])
            if not repeat:
                df = df[df["Names"].str.contains(chosen_name[i])==False]
        if display and not df.empty:
            print(df)
        if acowsay:
            cowsay.tux(', '.join(chosen_name))
        else:
            print(f"\nChosen Name/s: {', '.join(chosen_name)}")
        ask_choose_again()
    else:
        print("\nProgram Ended.\nList of names is now empty.")
        sys.exit(0)

That's it! We now have an offline random name picker that runs in our terminal. It's also great to use when you're concerned with data privacy for your names. The best thing is we can also use this program even if our list are not names like a list of truth or dare questions.

The statistics that will be shown will be an overview of your GitHub account. It shall display information such as total stars, forks, repository views, languages you used, and more.

A sample README.md for a GitHub user’s profile

Creating your GitHub Profile’s README.md​

1. Go to this link to create a new GitHub repository.

2. Use your username as the name of this repository like what I did in the image below.

   

   Create a new respository.

   Take note that GitHub is warning me because I have already created my own repository for the README file. In your case, there should be a green checkmark in the right side of the text box.

3. Initialize your new repository with a README file.

   

   Check the "Add a README file" option.

4. GitHub auto-generates the content of this README into something similar shown below.

   ### Hi there 👋
   
   <!--
   **joiellantero/joiellantero** is a ✨ _special_ ✨ repository because its `README.md` (this file) appears on your GitHub profile.
   Here are some ideas to get you started:
   - 🔭 I’m currently working on ...
   - 🌱 I’m currently learning ...
   - 👯 I’m looking to collaborate on ...
   - 🤔 I’m looking for help with ...
   - 💬 Ask me about ...
   - 📫 How to reach me: ...
   - 😄 Pronouns: ...
   - ⚡ Fun fact: ...
   -->
   

   If you’re not familiar with markdown, here are some resources for you to check out:

   • What is Markdown?
   • Markdown Basic Syntax

5. Edit this to your liking, and don’t forget to commit (and push if you’re not using GitHub’s web interface) your changes!

Generating your own statistics​

1. Visit this link and follow the installation instructions written on README.md.

2. After the workflow is done, go to the “generated” folder. You will see two files like the ones below.

   

3. Click on them and copy the URL leading to the image. Remember not to use “raw”. This is because we want the link to the image and not the SVG code itself.

   

4. Go to the repository you created earlier and open up the README.md file as we will now display the SVGs using the link that you copied.

   ![](<the link you copied for overview.svg here>)
   ![](<the link you copied for languages.svg here>)
   

   In my case, it would look something like this:

   ![](https://github.com/joiellantero/github-stats/blob/master/generated/overview.svg)
   ![](https://github.com/joiellantero/github-stats/blob/master/generated/languages.svg)
   

5. Commit (and push if you’re not using GitHub’s web interface) your changes and checkout your new GitHub profile!

6. Share this with others if you liked this tutorial.