honoki

#!/usr/bin/python3
import requests

def is_blacklisted(domain):
    blacklist  = open("/path/to/blacklist.txt")
    return domain in [w.strip() for w in blacklist.readlines()]

def request(flow):
    req = flow.request.method + ' ' + flow.request.path + ' ' + flow.request.http_version + '\n'

Arno0x

/*
Author: Arno0x0x, Twitter: @Arno0x0x
Completely based on @Flangvik netloader

This partial rewrite of @Flangvik Netloader includes the following changes:

	- Allow loading of an XOR encrypted binary to bypass antiviruses
		To encrypt the initial binary you can use my Python transformFile.py script.
		Example: ./transformFile.py -e xor -k mightyduck -i Rubeus.bin -o Rubeus.xor
		

harisec

so, you can read WEB-INF/web.xml. how can you escalate this issue?

[step 1]. try to read other common Java files such as WEB-INF/web-jetty.xml. 

use a specialized wordlist such as the following (from 	Sergey Bobrov/BlackFan):
https://github.com/BlackFan/WEB-INF-dict/blob/master/web-inf.txt
with time you can build your own wordlist adding files you've discovered over time.
use Burp Intruder for this, it's perfect for this job.
sort Intruder results by status code so you can see instantly which files were found.

nickpopovich

import random

header_names = ['User-Agent']

ua = ['Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36', 'Mozilla/5.0 (Linux; Android 6.0; CAM-L21 Build/HUAWEICAM-L21; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/62.0.3202.84 Mobile Safari/537.36', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36']

if (messageIsRequest):
        request = helpers.analyzeRequest(messageInfo)
        headers = request.getHeaders()
        for header_name in header_names:

G0ldenGunSec

As always, only for use on networks you own or have permission to test against. 

Similar functionality to SpiderLabs SCShell (https://github.com/SpiderLabs/SCShell) but from the command line using WMIC to run commands on other systems remotely.
If attempting to run multiple commands, SCShell will probably be move convenient as it automates the below steps.  However, for one-offs this works fine as well.

The process involves a total of four commands, three of which can be combined on the command line to form one large block.

Step 1: Get the current pathName of your target service so we can restore it once we've ran our command (in our case XblAuthManager)
    wmic /user:DOMAIN\USERNAME /password:PASSWORD /node:TARGET_IP service where name='XblAuthManager' get pathName

BlackFan

CVE-2019-8331

Bootstrap < 3.4.1 || < 4.3.1

✔️ CSP strict-dynamic bypass

➖ Requires user interaction

➖ Requires $('[data-toggle="tooltip"]').tooltip();

JonathanLPoch

#!/bin/sh

DEFAULTNMAPOPTIONS="-T4 -sV -Pn --top-ports 5000 -R"
NMAPOPTIONS="$DEFAULTNMAPOPTIONS"

die() {
	printf '\033[38;5;9m%s\033[0m\n\n' "$1" >&2
	display_usage
	exit 1
}

yassineaboukir

0
00
01
02
03
1
1.0
10
100
1000

marzavec

/*
  Developer: Marzavec ( https://github.com/marzavec )
  Description: A simple browser-based subdomain bruteforcing script, using DoH providers. Developed as a 5 minute hack, just to see it's preformance. Many improvements could be made, such as adding error handling or informing the user when the script is done.
  Usage: Open the browsers dev console (usually F12), paste this script, change the `rootTld`, press enter to run. Ezpz.
*/

const rootTld = 'lyka.pro'; // change to your target's root tld

// url to newline seperated wordlist
const wordlistUrl = 'https://raw.githubusercontent.com/rbsec/dnscan/master/subdomains.txt';

righettod

# The situation is the following:
# Your enter ab in a feature and it return data to you but when your enter ab' it indicate that there is not data found.
#
# So, does it means that there is no SQLi because ab' is well handled OR the error is catched
# and a "not data found message" is returned?
#
# The goal here is to submit a payload that, if interpreted by the SQL DB, will give ab and then data will be returned
# then indicating that there is a SQLi because the payload is interpreted.
ab';#
ab';--