plowsec

import shutil
import subprocess
import tempfile
import traceback
import json
import os
import typing
import logging
import sys
import pathlib

plowsec

#include <winsock2.h>

#define _WIN32_WINNT 0x0600
#include <windows.h>
#include <stdio.h>
#include <Psapi.h>
#include <tlhelp32.h>
#include <winternl.h> 
#include <string.h>
#include <stdlib.h>

plowsec

import tempfile

from pyzbar.pyzbar import decode
from PIL import Image
import random
from tqdm import tqdm

def unshuffle3x3GridImage(shuffled_image_path, output_path, seed):
    # Initialize the random seed to match the shuffle
    random.seed(seed)

plowsec

sql injection from string concatenation

.(delete_all|from|where|find_by)\s*\((?:"[^"]*#\{[^\}]+\}"|'[^']*#\{[^\}]+\}'|:\w+\s*=>\s*[^)]+)\)

plowsec

Github Actions workflow:

name: Build Tree-sitter Grammar

on:
  workflow_dispatch:

jobs:
  build:

plowsec

sudo apt install open-vm-tools open-vm-tools-desktop
nohup /usr/bin/vmtoolsd -n vmusr &
vmhgfs-fuse .host:/SHARE_NAME /home/lol/share -o subtype=vmhgfs-fuse

# setup zsh with fish completion
sudo apt install curl zsh
chsh -s $(which zsh)
sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
git clone https://github.com/zsh-users/zsh-autosuggestions ~/.zsh/zsh-autosuggestions

plowsec

SQL Injection

• jdbcTemplate.query(
• createStatement(
• executeQuery(
• executeUpdate(

Cross-Site Scripting (XSS)

• .addAttribute(
• Thymeleaf: ${}
• JSP: <%= %>

plowsec

recursively download all files matching 2 extensions of a remote machine

rsyc -avz --include='*.pyc' --include='*.cgi' --include='*/' --exclude='*' xxx@xxx:/xxx/ SomeFolderThatWillBeCreatedByRsync

Decompile all pyc in a folder

(Or run a command on all files matching an extension, replacing the extension in the output file)

plowsec

#!/bin/bash


set -x
set -e

echo "Don't forget to save the credentials that I will generate for you"

# Test to see if user is running with root privileges.
if [[ "${UID}" -ne 0 ]]

plowsec

Potential Vulnerabilities in Next.js Applications

XSS

1. Embedding Unsanitized Data in JavaScript

<script>
    let username = '{userInput}';
</script>