Skip to content

Instantly share code, notes, and snippets.

@joincode
joincode / tool.py
Created June 10, 2025 23:43 — forked from SecFathy/tool.py
Identify and confirm reflected XSS vulnerabilities using parameter discovery + AI-based validation (via Gemini API).
import warnings
from urllib3.exceptions import NotOpenSSLWarning
warnings.filterwarnings("ignore", category=NotOpenSSLWarning)
import subprocess
import requests
import urllib.parse
import json
import os
from datetime import datetime
@joincode
joincode / 0-hidden-service-subdomains.md
Created May 6, 2021 16:14 — forked from mtigas/0-hidden-service-subdomains.md
Example code for running a (HTTP/HTTPS) Tor hidden service supporting subdomains.

The following files show an example of how to create subdomains for onion site hidden services. (This hasn't been tested for hidden services for anything other than HTTP/HTTPS.)

(You might also want to read our blog post about ProPublica’s Tor hidden service, including a tutorial and notes on running a hidden service: https://www.propublica.org/nerds/item/a-more-secure-and-anonymous-propublica-using-tor-hidden-services )

In general, this works (maybe just in recent Tor clients) because Tor will handle the connection to www.xxxxxxxxxxxxxxxx.onion as a connection to xxxxxxxxxxxxxxxx.onion. The encapsulated HTTP/HTTPS connection contains the subdomain in the Host: header (and in the case of HTTPS, the SNI