snyff

require 'koriand3r'

@pages = []

def run()
  requests.extract(:uri) do |c|
    name = c.split("=")[0]
    @pages << name unless @pages.include?(name)
  end
end

snyff

HTTP/1.1 200 OK 
Content-Type: text/html;charset=utf-8
Content-Length: 1436
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Server: WEBrick/1.3.1 (Ruby/1.9.3/2012-04-20)
Date: Tue, 13 Feb 2018 07:39:00 GMT
Connection: Keep-Alive
Set-Cookie: auth=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjpudWxsfQ.pgMKdpUKL8fYGe79FRUR2mBLCsJRGI1DjVDwrRs_9mo; domain=0.0.0.0; path=/; HttpOnly

snyff

k = OpenSSL::PKey::RSA.new File.read 'private.pem'
pub = k.public_key
jwks = {
  "keys"=> [
    {
      "kty"=> "RSA",
      "use"=> "sig",
      "alg": "RS256",
      "kid"=> "pentesterlab",
      "n" => Base64.urlsafe_encode64(pub.n.to_s(2), padding: false),

snyff

#pip install ecdsa
#
import base64
import hashlib
from hashlib import sha256
import hmac

from ecdsa.ecdsa import Signature, generator_256

from ecdsa import VerifyingKey, NIST256p