Skip to content

Instantly share code, notes, and snippets.

Evan J Johnson ejcx

Block or report user

Report or block ejcx

Hide content and notifications from this user.

Learn more about blocking users

Contact Support about this user’s behavior.

Learn more about reporting abuse

Report abuse
View GitHub Profile
View respirator.go
package main
import (
"bufio"
"encoding/json"
"fmt"
"log"
"os"
"strings"
)
@ejcx
ejcx / top-700k.json
Created Feb 24, 2016
Alexa Top 700k Survey
View top-700k.json
{"":"","HTTP/1.1 200 OK":"","access-control-allow-credentials":"true","access-control-allow-origin":"http://evil.com.ej.cx","cache-control":"no-store, no-cache, must-revalidate, post-check=0, pre-check=0","content-type":"text/html","date":"wed, 24 feb 2016 01:17:21 gmt","expires":"thu, 19 nov 1981 08:52:00 gmt","pragma":"no-cache","server":"apache/2.2.22 (ubuntu)","set-cookie":"phpsessid=2phdir1nkjt822p5lelc2vtf65; path=/","vary":"accept-encoding","x-hostname":"http://.ej.cx","x-powered-by":"php/5.3.10-1ubuntu3.21"}
{"":"","HTTP/1.1 302 Found":"","access-control-allow-credentials":"true","access-control-allow-methods":"get, head, post, put, patch, delete, options","access-control-allow-origin":"https://wetransfer.com.evil.com","access-control-expose-headers":"","access-control-max-age":"60","cache-control":"no-cache","connection":"keep-alive","content-type":"text/html; charset=utf-8","date":"wed, 24 feb 2016 01:17:55 gmt","location":"https://www.wetransfer.com/","server":"nginx","status":"302 found","vary":"o
View trickery.sh
root@ejjio:/var/www/misconfigured-cors# curl -H "Origin: https://ejj.io.evil.com" https://ejj.io -I
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Wed, 24 Feb 2016 06:47:21 GMT
Content-Type: text/html
Set-Cookie: PHPSESSID=sd7ejaf2lufukhq7se49lmsg76; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Origin: https://ejj.io.evil.com
Access-Control-Allow-Credentials: true
@ejcx
ejcx / flight.go
Created Mar 23, 2019
Flight Server
View flight.go
package main
import (
"fmt"
"io/ioutil"
"log"
"net/http"
"time"
)
View tmux.conf
set -g default-terminal "xterm-256color"
setw -g xterm-keys on
setw -g mode-keys vi
bind -r H resize-pane -L 5
bind -r J resize-pane -D 5
bind -r K resize-pane -U 5
bind -r L resize-pane -R 5
bind -r C-h select-window -t :-
bind -r C-l select-window -t :+
bind h select-pane -L
View jwtex_test.go
package jwtex
import (
"encoding/base64"
"encoding/json"
"fmt"
"strings"
"testing"
)
View gist:0c73a8ad6de520ce81ecd296c6dda340
addEventListener('fetch', event => {
event.respondWith(fetch('https://slot1.mysite.com'))
})
View gist:0083688d3772009bb10feb5acd7c663a
### Keybase proof
I hereby claim:
* I am ejcx on github.
* I am twitter (https://keybase.io/twitter) on keybase.
* I have a public key whose fingerprint is D715 1D01 C032 5376 A36E D4D2 6A2A C268 A23B 940F
To claim this, I am signing this object:
View cors-scanner.sh
#!/bin/sh
while read -r domain
do
# Remember. Account for the fact that some sites don't exist on HTTP
# And others don't exist on HTTPS. Prune later.
curl -I "https://$domain" --max-time 3 -H "Origin: https://$domain.evil.com" | ./respirator&
curl -I "http://$domain" --max-time 3 -H "Origin: http://$domain.evil.com" | ./respirator&
done < "top1mdomains"
View wf.sh
#!/bin/zsh
wf() {
curl -s "https://www.wolframalpha.com/input/autocomplete.jsp?i=$@" | \
jq '.instantMath' | \
jq 'select(.approximateResult != null).approximateResult, select(.exactResult != null).exactResult'
}
You can’t perform that action at this time.