Skip to content

Instantly share code, notes, and snippets.

View bl4de's full-sized avatar
🇺🇦
#StandWithUkraine

Rafal Janicki bl4de

🇺🇦
#StandWithUkraine
View GitHub Profile
@bl4de
bl4de / index.html
Created October 31, 2018 17:06
A simple website with dynamically added P element
<html>
<head>
<title>Dynamic P Application</title>
<style>
* {
font-size:18px;
font-weight:bold;
color: #2e2e2e;
}
</style>
@bl4de
bl4de / index.html
Created October 31, 2018 13:36
Sample HTML with elements which will be invisible
<html>
<head>
<title>Move along, nothing to see here!</title>
<style>
/* note to myself: add CSS from Bob's repo: https://verysecurecompany.com/__internal__/repo/bob/specs.git */
* {
font-size:16px;
color: #c0c0c0;
}
</style>
@bl4de
bl4de / web-servers.md
Created October 23, 2018 03:51 — forked from willurd/web-servers.md
Big list of http static server one-liners

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000
@bl4de
bl4de / censys-search.py
Created August 24, 2018 20:34
Censys IO search script from Hack Like a Legend by SparcFlow
#!/usr/bin/python
# Replace the UID and SECRET variables with your own API keys from censys.io
import sys
import json
import requests
if len(sys.argv) < 2:
print "usage " + sys.argv[0]+" <domain>";
sys.exit();
@bl4de
bl4de / cloud_metadata.txt
Created July 8, 2018 15:28 — forked from jhaddix/cloud_metadata.txt
Cloud Metadata Dictionary useful for SSRF Testing
## AWS
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
@bl4de
bl4de / better-nodejs-require-paths.md
Created June 6, 2018 13:54 — forked from branneman/better-nodejs-require-paths.md
Better local require() paths for Node.js

Better local require() paths for Node.js

Problem

When the directory structure of your Node.js application (not library!) has some depth, you end up with a lot of annoying relative paths in your require calls like:

var Article = require('../../../models/article');

Those suck for maintenance and they're ugly.

Possible solutions

@bl4de
bl4de / test.js
Created May 11, 2018 01:12
Bypass tests
var filename = "/var/www/index.html"
var path = filename + ".log"
console.log(path) // /var/www/index.html.log
filename = "/var/www/index.html\x00\x0a"
path = filename + ".log"
@bl4de
bl4de / settings.json
Created February 8, 2018 15:55
My VSCode user settings
// Place your settings in this file to overwrite the default settings
{
"editor.fontFamily": "monospace, 'Droid Sans Fallback'",
// Controls if the minimap is shown
"editor.minimap.enabled": true,
"explorer.autoReveal": false,
"extensions.autoUpdate": true,
"editor.renderIndentGuides": false,
"editor.rulers": [
80,
@bl4de
bl4de / report_template
Last active February 8, 2018 15:56
Node.js bugbounty program report template
There is [VULNERABILITY] in [MODULE]
It allows [WHAT IT ALLOWS - EG. READ ARBITRARY FILES, READ DATA FROM DATABASE ETC.]
## Module
**[MODULE NAME]**
[DESCRIPTION - JUST FOR REFERENCE; COPIED FROM NPM MODULE PAGE]
https://www.npmjs.com/package/[MODULE NAME]
@bl4de
bl4de / sed
Last active January 5, 2018 16:49
sed
Sed
- delimiters
s///
s:::
s___
Anything can be used as delimiter as long as it's not in the text itself