IMPORTANT: Backup your nginx site configs (usually under /etc/nginx/sites-available
)!
Remove old nginx incl. nginx-common:
apt-get autoremove --purge nginx nginx-common
<?php | |
//php gd-gif.php image.gif gd-image.gif | |
$gif = imagecreatefromgif($argv[1]); | |
imagegif($gif, $argv[2]); | |
imagedestroy($gif); | |
?> |
{ | |
"卧": "臣卜", | |
"项": "工页", | |
"功": "工力", | |
"攻": "工攵", | |
"荆": "茾刂", | |
"邪": "牙阝", | |
"雅": "牙隹", | |
"期": "其月", | |
"欺": "其欠", |
axios({ | |
url: 'http://localhost:5000/static/example.pdf', | |
method: 'GET', | |
responseType: 'blob', // important | |
}).then((response) => { | |
const url = window.URL.createObjectURL(new Blob([response.data])); | |
const link = document.createElement('a'); | |
link.href = url; | |
link.setAttribute('download', 'file.pdf'); | |
document.body.appendChild(link); |
var dns = require('dns'); | |
var net = require('net'); | |
var axfrReqProloge = | |
"\x00\x00" + /* Size */ | |
"\x00\x00" + /* Transaction ID */ | |
"\x00\x20" + /* Flags: Standard Query */ | |
"\x00\x01" + /* Number of questions */ | |
"\x00\x00" + /* Number of answers */ |
#!/usr/bin/env python2 | |
# lrdcq | |
# usage python2 unwxapkg.py filename | |
import sys, os | |
import struct | |
class WxapkgFile(object): | |
nameLen = 0 |
Many mobile apps have back-end API servers. They usually rely on the API replies to determine whether certain information is supposed to be shown. If the API responses could be manipulated on the fly, we may easily fool an unmodified app to expose some private data.
This manual guides you to set up nginx as non-transparent SSL proxy, which just subsitutes strings in the server responses (i.e. man-in-the-middle attack ourself). For both server-side (their API servers) and client-side (your device), the whole process is almost transparent.
/robots.txt | |
/index.php?a=1%3Cscript%3Ealert(abc)%3C/script%3E | |
/nevercouldexistfilenosec | |
/nevercouldexistfilewebsec | |
/nevercouldexistfilenosec.aspx | |
/nevercouldexistfilewebsec.aspx | |
/nevercouldexistfilenosec.shtml | |
/nevercouldexistfilewebsec.shtml | |
/nevercouldexistfilenosec/ | |
/nevercouldexistfilewebsec/ |
#!/bin/bash | |
# Slightly modified version from https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh | |
# Run with sudo ./openvpn-install.sh and not sudo sh ./openvpn-install.sh as read command has issues with external triggering of scripts | |
# OpenVPN road warrior installer for Debian, Ubuntu and CentOS | |
# This script will work on Debian, Ubuntu, CentOS and probably other distros | |
# of the same families, although no support is offered for them. It isn't | |
# bulletproof but it will probably work if you simply want to setup a VPN on | |
# your Debian/Ubuntu/CentOS box. It has been designed to be as unobtrusive and | |
# universal as possible. |