Skip to content

Instantly share code, notes, and snippets.


Mehtab Zafar mzfr

View GitHub Profile
securityMB /
Last active Jul 16, 2021
Twitter quiz solution

Yesterday I posted a little quiz on Twitter about HTML parsing.

The question was: what element is going to be the parent of the final <s> in the following snippet of HTML:


The final answers are:

me0wday /
Last active Aug 3, 2021
Blind Graphql Discovery to Altair Schema

Playing with GraphQL when introspection is disabled

Quick write up on extracting a GraphQL schema when introspection is disabled. Bits and pieces sourced from various sources. Successfully tested on an Apollo instance.

TLDR: Some GraphQL instances provide name autocomplete suggestions. Some peeps have written tools to automate the extraction process. (ref

1. Bruteforce schema without introspection

First step is using a tool called clairvoyance by @nikitastupin ( I found the main repo to lack error handling and support for additional features such as proxy.

tobi / kindle.rb
Last active Apr 5, 2021
Download your Kindle Highlights to local markdown files. Great for
View kindle.rb
#!/usr/bin/env ruby
# gem install active_support
require 'active_support/inflector'
require 'active_support/core_ext/string'
# gem install webrick (only ruby3)
require 'webrick'
# gem install mechanize
prologic /
Last active Nov 17, 2021
Learn Go in ~5mins
multiplex3r /
Last active Apr 15, 2021
Load a PCAP into neo4j with scapy
#!/usr/bin/env python3
from scapy.all import *
from py2neo import Graph, Node, Relationship
packets = rdpcap("<your_pcap_file>")
g = Graph(password="<your_neo4j_password>")
for packet in packets.sessions():
pkt = packet.split()
pich4ya / root_bypass.js
Created Aug 5, 2019
Bypass Android Root Detection / Bypass RootBeer - August 2019
View root_bypass.js
// $ frida -l antiroot.js -U -f --no-pause
// CHANGELOG by Pichaya Morimoto (
// - I added extra whitelisted items to deal with the latest versions
// of RootBeer/Cordova iRoot as of August 6, 2019
// - The original one just fucked up (kill itself) if Magisk is installed lol
// Credit & Originally written by:
// If this isn't working in the future, check console logs, rootbeer src, or
Java.perform(function() {
var RootPackages = ["", "", "eu.chainfire.supersu",
bessarabov / gist:674ea13c77fc8128f24b5e3f53b7f094
Last active Nov 25, 2021
One-liner to generate data shown in post 'At what time of day does famous programmers work?' —
View gist:674ea13c77fc8128f24b5e3f53b7f094
git log --author="Linus Torvalds" --date=iso | perl -nalE 'if (/^Date:\s+[\d-]{10}\s(\d{2})/) { say $1+0 }' | sort | uniq -c|perl -MList::Util=max -nalE '$h{$F[1]} = $F[0]; }{ $m = max values %h; foreach (0..23) { $h{$_} = 0 if not exists $h{$_} } foreach (sort {$a <=> $b } keys %h) { say sprintf "%02d - %4d %s", $_, $h{$_}, "*"x ($h{$_} / $m * 50); }'
akabe1 / frida_multiple_unpinning.js
Last active Nov 28, 2021
Another Android ssl certificate pinning bypass for various methods
View frida_multiple_unpinning.js
/* Android ssl certificate pinning bypass script for various methods
by Maurizio Siddu
Run with:
frida -U -f [APP_ID] -l frida_multiple_unpinning.js --no-pause
setTimeout(function() {
Java.perform(function() {
# Values from the white paper
EXAMPLE_PHDR = 'L2 F\' B2 U D2 B U D\' F2 L\' F U2 R U\' L\' R\' U\' B F D U\''.split(" ")
EXAMPLE_LHDR = 'B U2 D2 R\' F U2 B R L\' B L\' B L\' D F\' L U\' B2 R F2 L\' F2'.split(" ")
EXAMPLE_MSG = 'F L U2 L2 F\' B D\' B2 L\' B\' U L2 F\' R2 D\' B\' U\' L\' B R D2 L2 R\' B F2 D\' U R B D2 U2 R2 U\' F2 R2 F D F2 B2 D\' R\' D R\' U\' F\' B2 U F2 D R U L F U2 L2 D R B D\' B\' U L U\''.split(" ")
# Values from the challenge
CHALL_PHDR = 'B2 R U F\' R\' L\' B B2 L F D D\' R\' F2 D\' R R D2 B\' L R'.split(" ")
CHALL_LHDR = 'L\' L B F2 R2 F2 R\' L F\' B\' R D\' D\' F U2 B\' U U D\' U2 F\''.split(" ")
CHALL_MSG = 'L F\' F2 R B R R F2 F\' R2 D F\' U L U\' U\' U F D F2 U R U\' F U B2 B U2 D B F2 D2 L2 L2 B\' F\' D\' L2 D U2 U2 D2 U B\' F D R2 U2 R\' B\' F2 D\' D B\' U B\' D B\' F\' U\' R U U\' L\' L\' U2 F2 R R F L2 B2 L2 B B\' D R R\' U L'.split(" ")
matt-bailey /
Last active Nov 13, 2021
How to set up DNS records on to use a custom domain on Github Pages

How to set up DNS records on to use a custom domain on Github Pages

You would think it would be easy to find this information, but none of the Github or Gandi documentation is clear so I have recorded the required steps here.

Create the following A records:

@ 1800 IN A
@ 1800 IN A
@ 1800 IN A