morkin1792

if [ -z $(which adb) ]; then
    echo -e 'adb not found\nexiting...'
    exit 0
fi
serial=$(adb devices | grep -w device | awk '{print $1}')
if [ -z "$serial" ]; then
    echo 'no device found via adb'
    exit 0
fi
if [ $(echo $serial | wc -l) -ne 1 ]; then

morkin1792

xss.md

injection points

1. script tags
2. attributes with event handler value (onload, onerror, ...)

• 2.1. some here
• 2.2. to discover others: search for events accepted by the app (use this list) and try to evolve to an xss
• 2.3. alert(1) == location=window.atob`amF2YXNjcmlwdDphbGVydCgxKQoK`

3. attributes with URL value

• 3.1. embed/src, iframe/src, object/data, a/href, button/formaction, form/action more in https://www.w3.org/TR/2017/REC-html52-20171214/fullindex.html#attributes-table

morkin1792

import os
from prompt_toolkit import PromptSession
from prompt_toolkit.completion import WordCompleter
from prompt_toolkit.history import FileHistory

#https://python-prompt-toolkit.readthedocs.io/en/master/pages/asking_for_input.html#history
class Console():

    def __init__(self):
        self.session = PromptSession(

morkin1792

#install xfce4

sudo apt install -y xrdp
systemctl enable xrdp
systemctl start xrdp
echo "xfce4-session" > ~/.xsession
echo '
export XDG_SESSION_DESKTOP=xfce4
export XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share:/usr/share:/usr/share

morkin1792

### speedo sign

local="$(cd "$(dirname "$0")"; pwd)"

cd "$local"
rm -f key.keystore

echo -en 'abc123\nabc123\n\n\n\n\n\n\nyes\n' | keytool -genkey -keystore key.keystore -alias alias -keyalg RSA -validity 10000 2>/dev/null >&2||
echo -en 'abc123\nabc123\n\n\n\n\n\n\nsim\n' | keytool -genkey -keystore key.keystore -alias alias -keyalg RSA -validity 10000 2>/dev/null
echo 'Signing...'

morkin1792

adding BURP (or another) ca certificate in android

Firstly export the certificate: Proxy > Options > Import/Export CA certificate > DER Format or download this via http://burp

without root

• put the certificate in android, access with a file manager, and install for "VPN and apps" (can be needed to rename the extension 'der' to 'cer')
• since android 7 (nougat), Apps that target API Level 24 and above no longer trust user or admin-added CAs for secure connections, by default. [1]
  • bypass here

with root

morkin1792

const test1 = (name) => {
    console.log(name)

    {
        console.log(name)
    }
}

const test2 = (name) => {
    console.log(name)

morkin1792

#!/usr/bin/env bash
start=$(date +%s)

link="$1"
price="$2"
command="$3"

function end() {
    echo -e '\nBoas compras...\nRodou por '$(($(date +%s)-start))' segundos'
    exit 0

morkin1792

-- Fonte algorítmo: https://en.wikipedia.org/wiki/Maze_generation_algorithm#Recursive_division_method
math.randomseed(os.time())
function generate(x, y) --gera uma table de table com # e ' ' no centro representando uma maze
  local r = {}
    for i=1,y do
        local ry = {}
        for j=1, x do
            if i ~= 1 and i~=y and j~=1 and j~=x then -- se não for das bordas
                table.insert(ry, ' ')
            else

morkin1792

#Multiboot USB - https://gist.github.com/morkin1792
#1.
#Instalar grub:
# grub-install --target=i386-pc --root-directory=/local/usb/montado /dev/sdX --force #instala grub no modo pc/bios
# grub-install --target=x86_64-efi --root-directory=/local/usb/montado /dev/sdX --removable #instala grub no modo uefi

#2.
#para instalar no modo uefi a particao do grub deve ser fat32 (esp partition), já no modo pc pode-se usar outros sistemas de arquivos
#as isos podem ficar em qualquer particao com 'qualquer' sistemas de arquivos, apenas deve-se setar o uuid dessa mais abaixo
#pode-se instalar em ambos os modos, pc/bios e uefi, se nao for feito apenas pcs com suporte para o modo escolhido bootarao o pendrive