Skip to content

Instantly share code, notes, and snippets.

View milo2012's full-sized avatar

Keith Lee milo2012

634 followers · 10 following
View GitHub Profile
@milo2012
milo2012 / portList-exploits.csv
Created December 30, 2016 05:33
portList-exploits.csv
0 exploits/windows/dcerpc/ms07_029_msdns_zonename []
10000 exploits/unix/webapp/webmin_show_cgi_exec []
10000 exploits/windows/backupexec/remote_agent []
10000 exploits/windows/oracle/osb_ndmp_auth []
10001 exploits/multi/misc/zend_java_bridge []
10008 exploits/windows/misc/gimp_script_fu []
1000 exploits/windows/http/altn_webadmin []
10050 exploits/unix/misc/zabbix_agent_exec []
10051 exploits/linux/misc/zabbix_server_exec []
10080 exploits/linux/antivirus/escan_password_exec []
@milo2012
milo2012 / uriList-exploits.csv
Created December 30, 2016 05:34
uriList-exploits.csv
/soap/ exploits/freebsd/misc/citrix_netscaler_soap_bof
/glpi/ exploits/multi/http/glpi_install_rce
/invoker/JMXInvokerServlet/ exploits/multi/http/jboss_invoke_deploy
/moodle/ exploits/multi/http/moodle_cmd_exec
/console/ exploits/multi/http/werkzeug_debug_rce
/SiteScope/ exploits/multi/http/hp_sitescope_issuesiebelcmd
/phpwiki/ exploits/multi/http/phpwiki_ploticus_exec
/cuteflow_v.2.11.2/ exploits/multi/http/cuteflow_upload_exec
/phpmyadmin/ exploits/multi/http/phpmyadmin_preg_replace
/blank-struts2/login.action/ exploits/multi/http/struts_code_exec_parameters
@milo2012
milo2012 / gist:f4984227bd063480d83c2bb275828863
Created April 15, 2017 09:22
Get-ChildItem -Path "C:\" -Recurse -Include *password*.txt | ForEach-Object{ Write-Output "$($_.FullName)"} | Set-Content “c:\temp\pathtofile.txt"
@milo2012
milo2012 / testOWA.py
Created May 9, 2017 18:22
Test Accounts on OWA (Outlook Web Access) Website.
import sys
from exchangelib import DELEGATE, IMPERSONATION, Account, Credentials, ServiceAccount, \
EWSDateTime, EWSTimeZone, Configuration, NTLM, CalendarItem, Message, \
Mailbox, Attendee, Q, ExtendedProperty, FileAttachment, ItemAttachment, \
HTMLBody, Build, Version
from exchangelib import DELEGATE, IMPERSONATION, Account, Credentials, \
EWSDateTime, EWSTimeZone, Configuration, NTLM, CalendarItem, Message, \
Mailbox, Attendee, Q
from termcolor import colored, cprint
import itertools
@milo2012
milo2012 / egblTest.py
Created November 28, 2017 05:45
Test Script for EquationGroupLeak EGBL CVE-2016-6909
import requests, urllib, os, sys
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
requests.packages.urllib3.disable_warnings()
#https://raw.githubusercontent.com/adamcaudill/EquationGroupLeak/master/Firewall/EXPLOITS/EGBL/EGBL.config
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 6.2; rv:30.0) Gecko/20150101 Firefox/32.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
@milo2012
milo2012 / getMoreDomains.py
Last active July 10, 2019 14:01
Get Domains Belonging to Organization from securitytrails.com
import requests
import json
import pprint
import sys
import dns.message
import dns.query
import dns.rdatatype
import dns.resolver
import dns.reversename
import time
@milo2012
milo2012 / gist:9e05075cdb8e2c900ac8e0faf540e781
Last active January 21, 2019 05:55
hostapd-wpe - Automate cert generation and starting of Hostapd-WPE that steals RADIUS credentials
import sys
import optparse
import os
pathName='/pentest/hostapd-wpe/certs/'
hostapdPath='/pentest/hostapd-wpe/'
'''
#Example
# python /pentest/eap.py -h
Usage: eap.py [options]
@milo2012
milo2012 / gist:62862b27f68dd64c5205d9c35f90216b
Last active January 26, 2018 21:40
Testing KRACK - Testing Access Points: Detecting a vulnerable FT Handshake (802.11r)
#The below checks if the Wireless Access Points supports FT-PSK key management protocol and how to use the scripts from https://github.com/vanhoefm/krackattacks-scripts to test if the Access Point is vulnerable to KRACK.
#The link https://github.com/kristate/krackinfo#vendor-response-complete contains list of vendor responses.
$ git clone https://github.com/vanhoefm/krackattacks-scripts
$ sh disable-hwcrypto.sh
#Reboot the system
#Modify /tmp/wpa_supplicant.conf to something similar to the below.
wpa_supplicant -D nl80211 -i wlan0 -c/etc/wpa_supplicant.conf
@milo2012
milo2012 / checkDF.go
Last active August 11, 2018 19:13
Sample Go Script to Check for Domain Frontable Domains
package main
import (
//"sync"
"fmt"
"net/http"
"strings"
"bufio"
"io/ioutil"
"archive/zip"
@milo2012
milo2012 / checkDomainForCDN.py
Created April 25, 2018 14:15
Check if any domains in Alexa top 1 million list is under any CDN and if so, which one is it
package main
import (
"sync"
//"strconv"
"io"
"net/http"
"archive/zip"
"path/filepath"
"bufio"