righettod

<?php
/**
 * Function to validate that a ZIP file do not contains "ZIP SLIP" payload entries.
 * @param string $zipFilePath Path to the ZIP to test.
 * @return bool TRUE only if the archive do not contains ZIP SLIP payload entries.
 * @link https://snyk.io/research/zip-slip-vulnerability
 * @link https://stackoverflow.com/a/3599093/451455 (inspired from)
 */
function isZipValid($zipFilePath){
    $isValid = false;

righettod

import json
import binascii
import hashlib
import argparse
from tabulate import tabulate

"""
Python3 script to find common entries in 2 export of a iOS device keychain performed via objection.

The objective is to help performing the following test of the OWASP MSTG:

righettod

import UIKit

//Inspired from the code below:
//https://github.com/takashings/ScreenCapturedSample/blob/master/ScreenCapturedSample/ForScreenCapturedViewController.swift
//https://www.hackingwithswift.com/example-code/uikit/how-to-detect-when-the-user-takes-a-screenshot
@UIApplicationMain
class AppDelegate: UIResponder, UIApplicationDelegate {
    
    func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
        //Define a listener to handle the case when a screen recording is launched

righettod

"""
Script was migrated below for better evolution and consistency:
https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/generate-report-retirejs.py
"""

righettod

The code has been transformed to the following project

righettod

Code sample

All librairies used are free and open source.

Java

/* 
  See https://pdfbox.apache.org 
  See https://mvnrepository.com/artifact/org.apache.pdfbox/pdfbox for released artifacts

righettod

<head>
   <!-- Big up to https://portswigger.net/web-security/clickjacking labs :) -->
   <style>
      .target_website {
      position:relative;
      width:800px;
      height:400px;
      #Set opacity to 0.5 to see overlay allowing preparation of the attack 
      #Set opacity to 0.00001 to made the target frame site transparent and bypass some browser protection on opacity like one in chrome for example
      #See https://www.w3schools.com/css/css_image_transparency.asp

righettod

# Simple dirty script to fuzz a SOAP request using the Burp Sniper approach: 
#     See https://portswigger.net/burp/documentation/desktop/tools/intruder/positions 
# Dependencies: 
#     pip install lxml requests_ntlm requests tabulate tqdm
import requests
import urllib3
from requests_ntlm import HttpNtlmAuth
from lxml import etree as ET
from tabulate import tabulate
from hashlib import sha1

righettod

# The situation is the following:
# Your enter ab in a feature and it return data to you but when your enter ab' it indicate that there is not data found.
#
# So, does it means that there is no SQLi because ab' is well handled OR the error is catched
# and a "not data found message" is returned?
#
# The goal here is to submit a payload that, if interpreted by the SQL DB, will give ab and then data will be returned
# then indicating that there is a SQLi because the payload is interpreted.
ab';#
ab';-- 

righettod

#!/usr/bin/python
# -*- coding: utf-8 -*-
"""
Script to verify, for a set of CVE, if the MITRE has released them
and if a link to the security advisory on the CVE owner site has been added.

Dependencies: pip install requests
"""
import requests
import collections