Sandeep Singh ehsandeep

🏠

Working from home

Co-Founder / CTO @projectdiscovery On a mission to simplify the security process and make it more accessible.

tehryanx / trufflehog.json

Last active June 3, 2022 08:26

High signal patterns from trufflehog refactored to work with tomnomnom's gf

harisec / exploit_path_traversals_in_Java_webapps.txt

Created April 27, 2020 10:24

quick primer on how to exploit path traversals in Java web apps (i.e. you can read WEB-INF/web.xml)

	so, you can read WEB-INF/web.xml. how can you escalate this issue?

	[step 1]. try to read other common Java files such as WEB-INF/web-jetty.xml.

	use a specialized wordlist such as the following (from Sergey Bobrov/BlackFan):
	https://github.com/BlackFan/WEB-INF-dict/blob/master/web-inf.txt
	with time you can build your own wordlist adding files you've discovered over time.
	use Burp Intruder for this, it's perfect for this job.
	sort Intruder results by status code so you can see instantly which files were found.

s0md3v / shodan_ports.txt

Created April 15, 2022 18:02

list of ports scanned by shodan