Skip to content

Instantly share code, notes, and snippets.

View bl4de's full-sized avatar
🇺🇦
#StandWithUkraine

Rafal Janicki bl4de

🇺🇦
#StandWithUkraine
868 followers · 76 following
View GitHub Profile
@bl4de
bl4de / wpeprivate-config.sh
Created January 23, 2019 08:46 — forked from hateshape/wpeprivate-config.sh
#!/bin/bash
# If you find a site with /_wpeprivate/config.json file exposed, run this and get all kinds of fun goodies.
# If it "no worked" (Technical Term) then you probably need to install jq!
TARGET=$1
TARGETDOMAIN=$(echo $TARGET | cut -d/ -f3)
# Pretty Colors
RESET='\033[00m'
GREEN='\033[01;32m'
@bl4de
bl4de / HashIdentifier.py
Created January 25, 2017 12:57
Hash identifier by BalalaikaCr3w Psycho_Coder
#!/usr/bin/env python
# encoding: utf-8
# Author: Psycho_Coder <https://psychocoder.github.io/>
from re import match
from sys import stdout, hexversion, exit, argv
import traceback
TITLE = """
_ _ _ _____ _ _ _ __ _
@bl4de
bl4de / gd-gif.php
Created March 31, 2020 16:44 — forked from asdqwe3124/gd-gif.php
<?php
//php gd-gif.php image.gif gd-image.gif
$gif = imagecreatefromgif($argv[1]);
imagegif($gif, $argv[2]);
imagedestroy($gif);
?>
@bl4de
bl4de / introspection-query.graphql
Created July 19, 2019 14:55 — forked from craigbeck/introspection-query.graphql
Introspection query for GraphQL
query IntrospectionQuery {
__schema {
queryType { name }
mutationType { name }
subscriptionType { name }
types {
...FullType
}
directives {
@bl4de
bl4de / wfuzz.log
Created June 16, 2019 09:12
wfuzz against example.com
bl4de:~ $ wfuzz -c --hc 404 -w ~/hacking/dictionaries/starter.txt http://example.com/FUZZ
Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 2.3.4 - The Web Fuzzer *
********************************************************
Target: http://example.com/FUZZ
Total requests: 71935
@bl4de
bl4de / crawl-extract-resolve.sh
Created May 8, 2019 22:55 — forked from noraj/crawl-extract-resolve.sh
crawl a web page, extract all domains and resolve them to IP addresses with bash and common GNU/Linux tools
#!/bin/bash
url='rawsec.ml'
domains=$(curl $url -s | grep -E 'https?://[^"]*' | cut -d '/' -f 3 | cut -d '"' -f 1 | uniq)
filename='/tmp/temporary_ips.txt'
for domain in $domains
do
@bl4de
bl4de / content_discovery_nullenc0de.txt
Created April 24, 2019 05:47 — forked from nullenc0de/content_discovery_nullenc0de.txt
content_discovery_nullenc0de.txt
This file has been truncated, but you can view the full file.
/
$$$lang-translate.service.js.aspx
$367-Million-Merger-Blocked.html
$defaultnav
${idfwbonavigation}.xml
$_news.php
$search2
£º
.0
/0
@bl4de
bl4de / README.md
Created April 5, 2019 07:21 — forked from ajxchapman/README.md
Scripts developed for solving HackerOne H1-702 2019 CTF

Scripts developed for solving HackerOne H1-702 2019 CTF

  • image_extract.py performs character extraction on targetted against the HackerOne H1-702 CTF announcement image
  • decrypt_sqli.py performs blind sqli data extraction with encrypted payloads targetting against the FliteThermostat API
  • timing_attack.py performs an HTTP piplining based timing against the FliteThermostat Backend
  • wordlist_generator.py generates wordlists from a give corpus or set of corpuses
  • httplib.py performs efficient asynchronous HTTP requests against the FliteThermostat Backend
@bl4de
bl4de / generate.c
Created March 4, 2019 11:26 — forked from munificent/generate.c
A random dungeon generator that fits on a business card
#include <time.h> // Robert Nystrom
#include <stdio.h> // @munificentbob
#include <stdlib.h> // for Ginny
#define r return // 2008-2019
#define l(a, b, c, d) for (i y=a;y\
<b; y++) for (int x = c; x < d; x++)
typedef int i;const i H=40;const i W
=80;i m[40][80];i g(i x){r rand()%x;
}void cave(i s){i w=g(10)+5;i h=g(6)
+3;i t=g(W-w-2)+1;i u=g(H-h-2)+1;l(u
@bl4de
bl4de / introspection_urlencoded.txt
Created February 7, 2019 23:37 — forked from localh0t/introspection_urlencoded.txt
Introspection query from GraphQL-JS (URL-encoded)
%0A%20%20query%20IntrospectionQuery%20%7B%0A%20%20%20%20__schema%20%7B%0A%20%20%20%20%20%20queryType%20%7B%20name%20%7D%0A%20%20%20%20%20%20mutationType%20%7B%20name%20%7D%0A%20%20%20%20%20%20subscriptionType%20%7B%20name%20%7D%0A%20%20%20%20%20%20types%20%7B%0A%20%20%20%20%20%20%20%20...FullType%0A%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20directives%20%7B%0A%20%20%20%20%20%20%20%20name%0A%20%20%20%20%20%20%20%20description%0A%20%20%20%20%20%20%20%20locations%0A%20%20%20%20%20%20%20%20args%20%7B%0A%20%20%20%20%20%20%20%20%20%20...InputValue%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%7D%0A%20%20%20%20%7D%0A%20%20%7D%0A%0A%20%20fragment%20FullType%20on%20__Type%20%7B%0A%20%20%20%20kind%0A%20%20%20%20name%0A%20%20%20%20description%0A%20%20%20%20fields(includeDeprecated%3A%20true)%20%7B%0A%20%20%20%20%20%20name%0A%20%20%20%20%20%20description%0A%20%20%20%20%20%20args%20%7B%0A%20%20%20%20%20%20%20%20...InputValue%0A%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20type%20%7B%0A%20%20%20%20%20%20%20%20...TypeRef%0A