Eno Leriand 0x3n0

🧠 Ranger God Preview Mode

Turn ranger into a full terminal malware triage & reverse engineering dock.

This is a heavily modified scope.sh preview script that transforms ranger into:

Red Team Recon Dock
Malware Research Quick Triage
Threat Intel IOC Extractor

GitHub Actions: Recon & Takeover

🎯 Goal

This workflow performs automated recon and subdomain takeover checks every time there's a push to the main branch. All results are stored in the results/ directory and automatically committed back to the repo.

🧪 Trigger

Overview

CVE-2025-32463 is a critical local privilege escalation vulnerability in the Sudo utility, affecting versions 1.9.14 to 1.9.17. With a CVSS score of 9.3, this flaw allows an unprivileged local user to execute arbitrary code as root by exploiting improper path resolution in Sudo’s --chroot (-R) option. Discovered by Qualys’ Threat Research Unit, the vulnerability stems from Sudo’s handling of the /etc/nsswitch.conf file within a user-controlled chroot environment, enabling the loading of a malicious shared library. This analysis details the vulnerability’s mechanics, exploitation process, impact, and mitigation strategies.

Technical Details

Affected Component

Software: Sudo (System Utility for Delegating Authority)
Versions: 1.9.14 to 1.9.17 (patched in 1.9.17p1)
Platforms: Linux systems using /etc/nsswitch.conf (e.g., Ubuntu, Debian, SUSE, Red Hat)
Introduced: The --chroot option, added in Sudo 1.9.14 to enhance containerized environment support

package main

import (
  "encoding/json"
  "flag"
  "fmt"
  "io/ioutil"
  "net/http"
  "os"

(function () {
  const suspiciousSources = [
    'location',
    'location.href',
    'location.search',
    'document.URL',
    'document.documentURI',
    'document.referrer'
  ];

(async function () {
    const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
    const clickMuteButton = async () => {
        const replies = document.querySelectorAll('[data-testid="tweet"]');
        for (const reply of replies) {
            const blueCheck = reply.querySelector('svg[aria-label="Verified account"]');
            if (blueCheck) {
                const moreOptionsButton = reply.querySelector('[aria-label="More"]');
                if (moreOptionsButton) {

Website Crawler for Clickjacking Detection Using X-Frame-Options and CSP

This script is a Go-based website crawler designed to detect potential vulnerabilities to clickjacking attacks. It works by examining HTTP headers such as X-Frame-Options and Content-Security-Policy.

Features:

Crawling Capability: Recursively scans all reachable URLs within the same domain starting from the base URL.
Header Analysis:
- Detects the presence and values of the X-Frame-Options header.
- Parses Content-Security-Policy directives for frame-ancestors to evaluate iframe embedding restrictions.
Vulnerability Classification:
- Protected: URLs with sufficient protections (X-Frame-Options or CSP frame-ancestors).

Penetration Testing Report for Target System 192.168.8.4 - August 2024

Date: August 13, 2024
Pentester: Eno Leriand

	const startDate = new Date('2022-01-01');
	const endDate = new Date('2023-01-01');

	const waitForElemToExist = async (selector, timeout = 5000) => {
	return new Promise((resolve) => {
	const element = document.querySelector(selector);
	if (element) return resolve(element);

	const observer = new MutationObserver(() => {
	const element = document.querySelector(selector);