Vinícius morkin1792

## pinning.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                morkin1792
                / pinning.md
            
            
              Last active
              March 2, 2024 00:50
            
              
                Bypassing Certificate Pinning 
              
          
    https://github.com/morkin1792/security-tests/blob/main/mobile/pinning.md

  
## Android.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                morkin1792
                / Android.md
            
            
              Last active
              March 2, 2024 00:49
            
              
                Android Application Pentesting - Part 0 - Cheat Sheet
              
          
    https://github.com/morkin1792/security-tests/blob/main/mobile/android_0.md

  
## subdomains.sh
https://github.com/morkin1792/security-tests/blob/main/subdomains.sh

## wordlists.sh
#!/usr/bin/env zsh
# reference
# https://wordlists.assetnote.io/
# https://github.com/danielmiessler/SecLists/
# https://github.com/fuzzdb-project/fuzzdb

BASE=(
    'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt'
    'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/Common-DB-Backups.txt'
    'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/Logins.fuzz.txt'

## gpg.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                morkin1792
                / gpg.md
            
            
              Last active
              September 1, 2023 01:16
            
              
                gpg examples
              
          
    create gpg key pair

gpg --full-generate-key
export public key

gpg --export --armor email@email > key.asc

  
## xss.md

      
              1 file
            
          
              0 forks
            
          
              1 comment
            
          
              2 stars
            
          
                morkin1792
                / xss.md
            
            
              Last active
              August 1, 2023 14:27
            
              
                mastering xss
              
          
    xss.md

injection points


script tags
attributes with event handler value (onload, onerror, ...)


2.1. some here
2.2. to discover others: search for events accepted by the app (use this list) and try to evolve to an xss
2.3. alert(1) == location=window.atob`amF2YXNjcmlwdDphbGVydCgxKQoK`


attributes with URL value


3.1. embed/src, iframe/src, object/data, a/href, button/formaction, form/action more in https://www.w3.org/TR/2017/REC-html52-20171214/fullindex.html#attributes-table


## findGithubEmails.sh
function findGithubEmails() {
    username="$1"
    remove_fork="${2:-N}"
    if [ -z $ZSH_VERSION ]; then
        printf "$(hostname): Oops, this script requires zsh! \n$(whoami): Why?\n$(hostname): Well... there are some problems, one of them is https://stackoverflow.com/q/59289355 \n$(whoami): You convinced me, how can I install zsh? \n$(hostname): https://itsfoss.com/zsh-ubuntu/ or https://github.com/ohmyzsh/ohmyzsh/wiki/Installing-ZSH\n"
        return
    fi

    function checkRateLimit() {
        if $(printf "%s" "$1" | grep -q 'rate limit'); then

## MyCanvasScaler.cs
using UnityEngine;
using UnityEngine.UI;

[RequireComponent(typeof(Canvas))]
[RequireComponent(typeof(CanvasScaler))]
public class MyCanvasScaler : MonoBehaviour
{
    [SerializeField] GameObject canvasContent;
    [SerializeField] bool keepProportions = true;
    Vector2 referenceResolution;

## game.js
var newhtml = `
<html>
<head>
  <style>
    iframe {
    	height: 100%;
        width: 100%;
    }
    body {
        background-color: black;

## debloat_miui.sh
if [ -z $(which adb) ]; then
    echo -e 'adb not found\nexiting...'
    exit 0
fi
serial=$(adb devices | grep -w device | awk '{print $1}')
if [ -z "$serial" ]; then
    echo 'no device found via adb'
    exit 0
fi
if [ $(echo $serial | wc -l) -ne 1 ]; then
	#!/usr/bin/env zsh
	# reference
	# https://wordlists.assetnote.io/
	# https://github.com/danielmiessler/SecLists/
	# https://github.com/fuzzdb-project/fuzzdb

	BASE=(
	'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt'
	'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/Common-DB-Backups.txt'
	'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/Logins.fuzz.txt'
	function findGithubEmails() {
	username="$1"
	remove_fork="${2:-N}"
	if [ -z $ZSH_VERSION ]; then
	printf "$(hostname): Oops, this script requires zsh! \n$(whoami): Why?\n$(hostname): Well... there are some problems, one of them is https://stackoverflow.com/q/59289355 \n$(whoami): You convinced me, how can I install zsh? \n$(hostname): https://itsfoss.com/zsh-ubuntu/ or https://github.com/ohmyzsh/ohmyzsh/wiki/Installing-ZSH\n"
	return
	fi

	function checkRateLimit() {
	if $(printf "%s" "$1" \| grep -q 'rate limit'); then
	using UnityEngine;
	using UnityEngine.UI;

	[RequireComponent(typeof(Canvas))]
	[RequireComponent(typeof(CanvasScaler))]
	public class MyCanvasScaler : MonoBehaviour
	{
	[SerializeField] GameObject canvasContent;
	[SerializeField] bool keepProportions = true;
	Vector2 referenceResolution;
	var newhtml = `
	<html>
	<head>
	<style>
	iframe {
	height: 100%;
	width: 100%;
	}
	body {
	background-color: black;
	if [ -z $(which adb) ]; then
	echo -e 'adb not found\nexiting...'
	exit 0
	fi
	serial=$(adb devices \| grep -w device \| awk '{print $1}')
	if [ -z "$serial" ]; then
	echo 'no device found via adb'
	exit 0
	fi
	if [ $(echo $serial \| wc -l) -ne 1 ]; then