ph5i’s gists

ph5i / redos.txt

Created October 14, 2024 09:41

redos

	((\w+)+)+$
	((a+)+)+$
	(.*\w){100}$
	(.*a){100}$
	([a-zA-Z]+)*$
	(\\w*)+$
	(\w*)+$
	(\w+)*$
	(\w?){100}$
	(\w\|a?)+$

ph5i / gau-ffuf-oneliner.sh

Created October 8, 2024 10:57

simple gau & ffuf oneliner

printf example.com | gau --subs | sort -u | grep -oP 'https?://[^/]+(\K/.*)' | ffuf -w - -u 'https://target.example.comFUZZ' -H "<session-cookies>"

ph5i / gist:6d5e0ff5826f6c2d965ba993193affb7

Created August 22, 2024 08:06

words-lowercase.txt

This file has been truncated, but you can view the full file.

	aahed
	aahing
	aahs
	aalii
	aaliis
	aals
	aargh
	aarrgh
	abaca
	abacas

ph5i / r.php

Created March 20, 2024 20:55

Redirect to arbitrary URLs via user-supplied input

	<?php
	$url = $_GET['u'];
	header("Location: $url");
	?>

ph5i / endpointz.py

Created March 19, 2024 14:53

Extract endpoints from a list of urls

	# ~/tools/endpointz.py urls.txt \| tee endpoints.txt
	import sys
	from urllib.parse import urlparse

	def extract_endpoints(urls):
	endpoints = set()
	for url in urls:
	parsed_url = urlparse(url)
	path = parsed_url.path.strip()
	if path:

ph5i / sample.html

Created February 23, 2024 09:37

sample_html.html

	<html>
	<script>alert(24)</script>
	</html>

ph5i / capitalizer.py

Created February 7, 2024 13:26

Capitalize the first letter of a list of words

	import sys

	def display_help():
	print("USAGE: python ~/tools/capitalizer.py input.txt output.txt\n")
	print("ARGS:")
	print(" [input_file] --> Input file containing a list of words")
	print(" [output_file] --> Output file to write the capitalized words")

	# Display help if --help flag is provided or if number of arguments is less than 2
	if "--help" in sys.argv or len(sys.argv) < 3:

ph5i / gist:ab02988c9ec670eae543e8c33320af03

Last active April 15, 2024 02:05

Fuzz for IDOR by bypassing/terminating regex/logic

	%00
	%01
	%02
	%03
	%04
	%05
	%06
	%07
	%08
	%09

ph5i / insertion-point-adder.sh

Created January 20, 2024 12:55

Adds insertion points to all values of variables, and saves the output to a new file. Useful when you're dealing with big requests that have a lot of variables and wish to perform some type of automated scanning on them in Burp Suite.

	#!/bin/bash
	# Example usage #
	#################
	# sample_req.txt == "var1=test&var2=test&var3=test&var4=test"
	# chmod +x ./insertion-point-adder.sh
	# ./insertion-point-adder.sh sample_req.txt --> "var1=§test§&var2=§test§&var3=§test§&var4=§test§"

	if [ "$#" -ne 1 ]; then
	echo "Usage: $0 <input_file>"
	exit 1

ph5i / SteamHoursPlayedLast2Weeks.py

Created January 20, 2024 12:50

Enter a users Steam ID and see how many hours they've played games for the past 2 weeks.

	import requests

	# Steam ID example: 76561198833313974
	api_key = "<REDACTED>"

	print("Enter Steam ID:")
	user_steamid = input()

	user_data = requests.get(f"http://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key={api_key}&steamids={user_steamid}").json()["response"]["players"][0]
	user_data_name = user_data["personaname"]

phsi ph5i