Astrogeorgeonethree

Stripe

Creating a User

https://stripe.com/docs/api/ruby#create_customer

Nmap Cheat Sheet

src: https://www.stationx.net/nmap-cheat-sheet

Target Specification

| Switch | Example | Description |

Getting Started with Nightmare.js

In today's Testing Analyst workshop, we played around with Nightmare.js, a JavaScript browser automation library that is useful for testing website interfaces.

It is easier to work with Nightmare on your computer, rather than to use it in Cloud9. Here are the instructions to install and get started.

Step 1. Install Node.js

JavaScript normally runs in the browser. Node.js is a version of JS that can run on a server, in a terminal, or on some other device. It allows you to easily prepare and run Nightmare scripts.

Remote Desktop for Kali Linux under Windows 10 WSL

Install Kali linus from the Win10 store.
Start Kali linux: $ kali
Install [wget]: apt-get install wget
Donwload the Kali installation script for [xfce4]: $ wget https://kali.shxfce4.sh
Run the script: $ sudo sh xfce4.sh

This will take some time.

Start the remote desktop server: $ sudo /etc/init.d/xrdp start

By default it will start on port 3390.

Vulnerable companies using Trello for Private Data

Some folks I believe are under the impression that Trello and other apps like it are more private than they are. These are some Google queries as a proof of concept, that demonstrate the issue. Note: Need to look into the Trello security settings to see if there is a sufficient work-around.

In a Google search:

Manually Searching OpenDirectories on Google

For videos/movies/tvshows :

intext:\"Search Term\" intitle:\"index.of\" +(wmv|mpg|avi|mp4|mkv|mov) -inurl:(jsp|pl|php|html|aspx|htm|cf|shtml)

Images :

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	#!/bin/bash
	# Converter.sh by @xdavidhu
	# This is a script inspired by the Bug Hunter's Methodology 3 by @Jhaddix
	# With this script, you can convert domain lists to resolved IP lists without duplicates.
	# Usage: ./converter.sh [domain-list-file] [output-file]

	echo -e "[+] Converter.sh by @xdavidhu\n"
	if [ -z "$1" ] \|\| [ -z "$2" ]; then
	echo "[!] Usage: ./converter.sh [domain-list-file] [output-file]"
	exit 1

	#!/usr/bin/env python
	# -- coding: utf-8 --
	#
	# Copyright (C) 2015-2018 Bitergia
	#
	# This program is free software; you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation; either version 3 of the License, or
	# (at your option) any later version.
	#

	#!/bin/bash
	# If you find a site with /_wpeprivate/config.json file exposed, run this and get all kinds of fun goodies.
	# If it "no worked" (Technical Term) then you probably need to install jq!

	TARGET=$1
	TARGETDOMAIN=$(echo $TARGET \| cut -d/ -f3)

	# Pretty Colors
	RESET='\033[00m'
	GREEN='\033[01;32m'