Kirill89

# For the URL https://share.vidyard.com/watch/ySQXtKoGAXS656HscU4yNe

curl https://play.vidyard.com/player/ySQXtKoGAXS656HscU4yNe.json | jq -r '.payload.chapters |.[0].sources.mp4 |.[0].url' > 1.txt && curl -H "Referer: https://play.vidyard.com/ySQXtKoGAXS656HscU4yNe" -vvv $(cat 1.txt) > 111.mp4

Kirill89

1. https://github.com/projectdiscovery/subfinder – a subdomain discovery tool
2. https://github.com/owasp-amass/amass – asset discovery
3. https://github.com/nmap/nmap – port enumiration
4. https://github.com/projectdiscovery/httpx – HTTP toolkit (server discovery)
5. https://github.com/tomnomnom/waybackurls – discover known URLs from Wayback Machine
6. https://github.com/lc/gau – discover known URLs from Wayback Machine and so on
7. https://github.com/trufflesecurity/trufflehog – secrets detection
8. https://github.com/projectdiscovery/nuclei – known vulnerabilities
9. https://github.com/ffuf/ffuf + https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content – discover hidden folders
10. https://github.com/OJ/gobuster – discover hidden folders

Kirill89

import path from 'node:path';
import {fileURLToPath} from 'node:url';

const SCRIPT_FOLDER = path.dirname(fileURLToPath(import.meta.url));
const DATA_FOLDER = path.join(SCRIPT_FOLDER, 'data');

Kirill89

/*
// Usage example:

async function scrapeUrl() {
  // ...
}
const urls = ['http://foo.com', 'http://bar.com', 'more URLs...'];

// Scrape all URLs with maximun 10 in parralel.
const scrapeUrlLimit = limit(10, scrapeUrl);

Kirill89

const fs = require('fs');

let data = fs.readFileSync('IRONCLAD.autosave.json', 'utf8');
const out = [];

for (let i = 0; i < data.length; i++) {
    const key = 'key';
    out.push(data.charCodeAt(i) ^ key.charCodeAt(i % key.length));
}

Kirill89

# Using libtool, lipo, ar and otool

lipo -info input.a

lipo -extract_family arm64 -output output.a input.a

# output.a is a fat file (use libtool(1) or lipo(1) and ar(1) on it)
# lipo output.a -thin arm64 -output output_arm64.a

ar -x output_arm64.a

Kirill89

FROM ubuntu:18.04

COPY ./app /app
RUN chmod u+s /app

RUN useradd -s /bin/bash just-user
USER just-user

Kirill89

FROM ubuntu:18.04

COPY ./app /app
RUN chmod u+s /app

RUN useradd -s /bin/bash just-user
USER just-user

Kirill89

// https://github.com/Kirill89/prototype-pollution-explained
const mergeFn = require('lodash').defaultsDeep;
const payloads = [
  '{"constructor": {"prototype": {"a0": true}}}',
  '{"__proto__": {"a1": true}}',
];

function check() {
  for (const p of payloads) {
      mergeFn({}, JSON.parse(p), {});

Kirill89

const fs = require('fs');
const util = require('util');

const readFile = util.promisify(fs.readFile);

fs.writeFileSync('a', 'a');

const attempts = 100000;

function runInCallback(left, cb) {