Skip to content

Instantly share code, notes, and snippets.

View k3mlol's full-sized avatar
🙊

k3mlol

🙊
66 followers · 56 following
  • MAMBO-9
View GitHub Profile
@k3mlol
k3mlol / get_subdomain.sh
Created January 11, 2019 06:44
grep -Eo '[a-z0-9\-\.]{2,}[com||cn||io||kr||jp||sg||us||uk||ca||br]' hosts.txt|sort -u
@k3mlol
k3mlol / wget_crt​_sh.sh
Created January 11, 2019 06:45
curl 'https://crt.sh/?q=%.'$1'&output=json' | jq '.name_value' | sed 's/\"//g' | sed 's/\*\.//g' | sort -u
@k3mlol
k3mlol / get_ip.sh
Created January 11, 2019 06:45
grep -Eo '[0-9]{1,3}(\.[0-9]{1,3}){3}' hosts.txt | sort -u > ip.txt
@k3mlol
k3mlol / install_redash.md
Created January 20, 2019 18:17

redash install

linux login postgresql sudo -u postgres psql

postgres postgresql

docker-compose -f docker-compose.production.yml run

@k3mlol
k3mlol / libxml2_XXE.md
Last active May 10, 2022 07:00
libxml2 XXE vuln

libxml2 XXE demo code

dpkg -s libxml2-dev
#output
Package: libxml2-dev
Status: install ok installed
Multi-Arch: same
Priority: optional
@k3mlol
k3mlol / gist:c3ac27a99c9a200b6a00ba44e544c62b
Created March 14, 2019 04:54
#!/bin/bash
git clone https://github.com/rapid7/metasploit-framework.git
git clone https://github.com/maurosoria/dirsearch.git
@k3mlol
k3mlol / fastjson_vuln_description.md
Last active July 11, 2019 05:58
fastjson反序列化漏洞

漏洞描述

fastjson某些版本存在远程代码执行高危安全漏洞。 影响范围: FastJSON 1.2.30及以下版本 FastJSON 1.2.41至1.2.47版本

修复建议

升级至FastJSON最新版本（1.2.48以上），建议升级至1.2.56以上版本。

@k3mlol
k3mlol / instll_gradle.sh
Created March 27, 2019 06:47
install gradle
#!/usr/bin/bash
#install gradle
wget https://services.gradle.org/distributions/gradle-3.4.1-bin.zip
sudo mkdir /opt/gradle
sudo unzip -d /opt/gradle gradle-3.4.1-bin.zip
#edit .bashrc or /etc/profile
export PATH=$PATH:/opt/gradle/gradle-3.4.1/bin
gradle -v
@k3mlol
k3mlol / wxapkg_unpack.py
Created April 29, 2019 02:29
unpack wenchat mini program
#!/usr/bin/python
# lrdcq
# usage python wxapkg_unpack.py filename, unpack at filename.unpack
import sys, os
import struct
class WxapkgFile:
@k3mlol
k3mlol / fix_xxe.md
Last active May 15, 2019 09:45
fix XXE

//source from https://pay.weixin.qq.com/wiki/doc/api/micropay.php?chapter=23_5

XXE漏洞需要您在回调处理代码里面解析XML之前，加入禁用实体解析的代码，不同语言设置的内容不同，下面提供了几种主流开发语言的设置指引(您可以根据关键字找到xml解析组件采取对应方法升级)：

【PHP】 解析XML代码前加入：

//下一行为关键代码
libxml_disable_entity_loader(true);	
$xml = simplexml_load_string($xmlContent);
......