Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to missing sanitisation in the Git.git method, which allows execution of OS commands rather than just Git commands.
Create a file named exploit.js with the following content:
var Git = require("git").Git;
Affected versions of this package are vulnerable to Arbitrary Code Execution. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system.
Create a file named exploit.js with the following content:
var dockerCLI = require('docker-cli-js');
CodeQL CLI includes a language server which can be easily set up in coc.nvim by adding the content of this coc-settings.json file to your own configuration file.
Given that coc.nvim uses Vim filetype detection system and not file extensions, you need to let Vim know about *.ql files being CodeQL files. One way to do that is to add codeql.vim to ~/.vim/ftdetect.
| /* | |
| * Google API keys finder by SkypLabs. | |
| * https://blog.skyplabs.net | |
| * @SkypLabs | |
| */ | |
| function scan(ps, msg, src) { | |
| var alertRisk = 0; // Informational | |
| var alertConfidence = 3; // High | |
| var alertTitle = "Information Disclosure - Google API Keys Found"; |
This small Python script converts a string into character codes.
Character codes are useful in XSS payloads when single and/or double quote characters can't be used to surround a string (escaped or removed from the payload). The JavaScript method [String.fromCharCode()][String.fromCharCode()] converts back the character codes into a string.
Example:
| ROOT=/data/local/tmp/mydebian | |
| BB=/system/xbin | |
| if ! ls $ROOT/proc/1 > /dev/null | |
| then | |
| $BB/mount --bind /dev $ROOT/dev | |
| $BB/mount --bind /proc $ROOT/proc | |
| $BB/mount --bind /sys $ROOT/sys | |
| $BB/mount --bind /dev/pts $ROOT/dev/pts | |
| fi | |
| export PATH=/bin:/sbin:/usr/bin:/usr/sbin |
| #!/usr/bin/env bash | |
| docker ps -a | grep 'Exit' | awk '{print $1}' | xargs docker rm |
| from scapy.all import * | |
| interface = "eth0" | |
| def print_packet(packet): | |
| ip_layer = packet.getlayer(IP) | |
| print("[!] New Packet: {src} -> {dst}".format(src=ip_layer.src, dst=ip_layer.dst)) | |
| print("[*] Start sniffing...") | |
| sniff(iface=interface, filter="ip", prn=print_packet) |
| FROM docker.io/node:8-stretch | |
| LABEL net.skyplabs.maintainer-name="Paul-Emmanuel Raoul" | |
| LABEL net.skyplabs.maintainer-email="[email protected]" | |
| ENV DEBIAN_FRONTEND=noninteractive | |
| RUN apt-get update \ | |
| && apt-get install -y --no-install-recommends chromium |
I hereby claim:
To claim this, I am signing this object:
