Skip to content

Instantly share code, notes, and snippets.

View fadyosman's full-sized avatar

Fady Othman fadyosman

59 followers · 5 following
View GitHub Profile
@fadyosman
fadyosman / fuzz.js
Created December 2, 2022 21:31
var payloads = ["javascript://", "javascript::", "JavaScript:", "javajavascript:script:"];
function doit(x, index) {setTimeout(function() {location.hash = "#" + x}, 1000 * index)}
payloads.forEach(doit);
@fadyosman
fadyosman / index.php
Last active November 15, 2022 21:18
Challenge code
<?php
// Try it a : http://ec2-54-242-83-247.compute-1.amazonaws.com/?id=asd
if(preg_match("/^[a-zA-Z0-9]+$/",$_REQUEST['id'])) {
echo "You entered: ".$_GET['id'];
} else {
echo "Sorry only alphanumeric characters are allowed.";
}
@fadyosman
fadyosman / challenge2_url.txt
Created November 13, 2022 17:54
http://ec2-54-242-83-247.compute-1.amazonaws.com/?id=asd
@fadyosman
fadyosman / index.html
Created October 31, 2022 18:54
JS Breakpoints
<html>
<head>
<script>
function filter(F) {
F = unescape(F).replace(/\n/g, "").replace(/\r/g, "").replace(/\t/g, "").replace(/javascript:/ig, '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
return F;
}
function locationHashChanged(e) {
var F = location.hash.substring(1);
@fadyosman
fadyosman / main.html
Created October 18, 2022 16:53
Sample for Javascript video
<html>
<head>
<title>JS monitor function demo</title>
<script src="main.js"></script>
</head>
<body>
<button onclick="add(1,2);">Call Add</button><br/>
<button onclick='makeRequest({"name":"test","url":"https://www.google.com/"});'>Call makeRequest</button><br />
<button onclick="first()">Read location.hash</button>
</body>
@fadyosman
fadyosman / example1.html
Created October 9, 2022 04:26
JS outdated library example
<head>
<title>Jquery XSS Example</title>
<script src="https://code.jquery.com/jquery-3.6.1.min.js"
integrity="sha256-o88AwQnZB+VDvE9tvIXrMQaPlFFSUTR+nldQm1LuPXQ=" crossorigin="anonymous"></script>
<script src="https://code.jquery.com/ui/1.12.1/jquery-ui.min.js"
integrity="sha256-VazP97ZCwtekAsvgPBSUwPFKdrwD3unUfSGVYrahUqU=" crossorigin="anonymous"></script>
<script>
function init() {
$("#datepicker").datepicker({ altField: "dangerous if your input reaches here" });
};
@fadyosman
fadyosman / index.html
Created September 23, 2022 14:37
Code for testing initiators
<html>
<head>
<title>
Devtools : initiators
</title>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js"
integrity="sha512-aVKKRRi/Q/YV+4mjoKBsE4x3H+BkegoM/em46NNlCqNTmUYADjBbeNefNxYV7giUp0VxICtqdrbqU7iVaeZNXA=="
crossorigin="anonymous" referrerpolicy="no-referrer"></script>
</head>
@fadyosman
fadyosman / zapcrawl.py
Created May 2, 2020 18:06
import sys
import requests
if len(sys.argv) < 3:
print("Usage : python3 zapcrawl.py urls.txt ZAP_API_KEY")
exit(0)
urlsfile = open(sys.argv[1], 'r')
urls = urlsfile.readlines()
api_key = sys.argv[2]
@fadyosman
fadyosman / sqlserver2008NativeClientLink
Created April 26, 2017 11:58
Sqlserver2008 Native Client Direct Link