Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file
GilbertoTorres
GilbertoTorres
/ content_discovery_nullenc0de.txt
Created
April 26, 2019 10:16
— forked from nullenc0de/content_discovery_nullenc0de.txt
content_discovery_nullenc0de.txt
This file has been truncated, but you can view the full file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| / | |
| $$$lang-translate.service.js.aspx | |
| $367-Million-Merger-Blocked.html | |
| $defaultnav | |
| ${idfwbonavigation}.xml | |
| $_news.php | |
| $search2 | |
| £º | |
| .0 |
GilbertoTorres
/ params.txt
Created
April 26, 2019 10:17
— forked from nullenc0de/params.txt
List of parameters for content discovery
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 0 | |
| 1 | |
| 11 | |
| 12 | |
| 13 | |
| 14 | |
| 15 | |
| 16 | |
| 17 | |
| 2 |
GilbertoTorres
/ fuzz.html
Created
April 26, 2019 10:20
— forked from LiveOverflow/fuzz.html
Fuzz innerHTML vs. DOMParser
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <html> | |
| <body> | |
| <script> | |
| const tags = ["a", "abbr", "address", "area", "article", "aside", "audio", "b", "base", "bdi", "bdo", "blockquote", "body", "br", "button", "canvas", "caption", "cite", "code", "col", "colgroup", "data", "datalist", "dd", "del", "details", "dfn", "dialog", "div", "dl", "dt", "em", "embed", "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "iframe", "img", "input", "ins", "kbd", "keygen", "label", "legend", "li", "link", "main", "map", "mark", "math", "menu", "menuitem", "meta", "meter", "nav", "noscript", "object", "ol", "optgroup", "option", "output", "p", "param", "picture", "pre", "progress", "q", "rb", "rp", "rt", "rtc", "ruby", "s", "samp", "script", "section", "select", "slot", "small", "source", "span", "strong", "style", "sub", "summary", "sup", "svg", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "title", "tr", "track", "u", "ul", "var", "video", "wbr"] |
GilbertoTorres
/ gist:fb0993d3a9646da994462ddfad3ffa10
Created
April 26, 2019 13:56
— forked from Viss/gist:e7c735ed389c8d055e6f31e845f25516
bash one liner for extracting shodan results for weblogic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| # this script was written by viss as a challenge from @random_robbie | |
| # This one-liner replaces a fairly lengthy python script | |
| # if you want to be walked through it, sign up for square cash, send $viss 20 dollars. Otherwise, flex your google fu! | |
| # oh, ps: you need to pip install shodan, and then configure the shodan cli client by giving it your api key. | |
| # then you're off to the races. | |
| shodan search --fields ip_str --limit 1000 'product:"Oracle Weblogic" port:"7001" country:"US"' | sort -u | nmap -sT -Pn -n -oG - -iL - -p 7001 | grep open | awk '{print $2}' | xargs -I % -n 1 -P 30 bash -c 'RESULT=`curl -s -I -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko0100101 Firefox/54.0" -H "Connection":"close" -H "Accept-Language":"en-US -H en;q=0.5" -H "Accept":"text/html -H application/xhtml+xml -H application/xml;q=0.9 -H */*;q=0.8" -H "Upgrade-Insecure-Requests":"1" %:7001/ws_utc/config.do | egrep HTTP`; echo "%: $RESULT";' |
GilbertoTorres
/ attributes.rb
Created
April 26, 2019 13:58
— forked from lizthegrey/attributes.rb
Hardening SSH with 2fa
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| default['sshd']['sshd_config']['AuthenticationMethods'] = 'publickey,keyboard-interactive:pam' | |
| default['sshd']['sshd_config']['ChallengeResponseAuthentication'] = 'yes' | |
| default['sshd']['sshd_config']['PasswordAuthentication'] = 'no' |
GilbertoTorres
/ all.txt
Created
May 3, 2019 08:25
— forked from jhaddix/all.txt
all wordlists from every dns enumeration tool... ever. Please excuse the lewd entries =/
This file has been truncated, but you can view the full file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| . | |
| .. | |
| ........ | |
| @ | |
| * | |
| *.* | |
| *.*.* | |
| 🎠|
GilbertoTorres
/ content_discovery_all.txt
Created
May 3, 2019 08:25
— forked from jhaddix/content_discovery_all.txt
a masterlist of content discovery URLs and files (used most commonly with gobuster)
This file has been truncated, but you can view the full file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ` | |
| ~/ | |
| ~ | |
| ×™× | |
| ___ | |
| __ | |
| _ |
GilbertoTorres
/ WAHH_Task_Checklist.md
Created
May 3, 2019 08:25
— forked from jhaddix/Testing_Checklist.md
The Web Application Hacker's Handbook - Task Checklist - Github-Flavored Markdown
GilbertoTorres
/ gist:cc72af0a39d331b313ee1a46f75d5dbd
Created
November 15, 2019 13:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ### Keybase proof | |
| I hereby claim: | |
| * I am gilbertotorres on github. | |
| * I am gilbertotorres (https://keybase.io/gilbertotorres) on keybase. | |
| * I have a public key ASBTquMTPKCKk58HO8frwqzIyr_rHqsr9j9KqjK7TF2xrQo | |
| To claim this, I am signing this object: |
GilbertoTorres
/ gist:bee9b1c6c89c3185056eacaf2c71fcb3
Created
November 15, 2019 13:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| gilbertotorres | |
| ### Keybase proof | |
| I hereby claim: | |
| * I am gilbertotorres on github. | |
| * I am gilbertotorres (https://keybase.io/gilbertotorres) on keybase. | |
| * I have a public key ASBTquMTPKCKk58HO8frwqzIyr_rHqsr9j9KqjK7TF2xrQo | |
| To claim this, I am signing this object: |
OlderNewer