Alexander Makedonsky n0z3r0

## Server-Side Template Injection - RCE For the Modern WebApp by James Kettle (PortSwigger).md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                n0z3r0
                / Server-Side Template Injection - RCE For the Modern WebApp by James Kettle (PortSwigger).md
            
            
              Created
              December 11, 2016 06:35
            
          
    > Dear ${user.first_name},
Dear sample01

> Dear ${user.password}
FreeMarket template error: the following has evaluated to null or missing...
Q: Is it safe to allow users to upload templates if they are untrusted?

  
## react-proptype-warnings-as-errors-with-sinon.markdown

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                n0z3r0
                / react-proptype-warnings-as-errors-with-sinon.markdown
            
            
              Created
              November 4, 2016 11:44
                — forked from scmx/react-proptype-warnings-as-errors-with-sinon.markdown
            
              
                Make React PropType warnings throw errors with mocha.js, enzyme.js and sinon.js
              
          
    Make React PropType warnings throw errors with enzyme.js + sinon.js + mocha.js

A simple stateless functional component that we want to test that it renders
without propType warnings.
import React, { PropTypes } from 'react'

let VersionListItem = function ({ active, version }) {
  return (

  
## cve-2014-6332_win7_ie11_poc.html
<html>
<head>
<!--
CVE-2014-6332 PoC to get meterpreter shell or bypass IE protected mode
- Tested on IE11 + Windows 7 64-bit

References:
- original PoC - http://www.exploit-db.com/exploits/35229/
- http://blog.trendmicro.com/trendlabs-security-intelligence/a-killer-combo-critical-vulnerability-and-godmode-exploitation-on-cve-2014-6332/
- http://security.coverity.com/blog/2014/Nov/eric-lippert-dissects-cve-2014-6332-a-19-year-old-microsoft-bug.html

## AndroidManifestDecompressor.groovy
    import java.io.FileInputStream;
    import java.io.FileNotFoundException;
    import java.io.IOException;
    import java.io.InputStream;
    import java.util.zip.ZipEntry;
    import java.util.zip.ZipFile;

    class AndroidXMLDecompress {
            // decompressXML -- Parse the 'compressed' binary form of Android XML docs
            // such as for AndroidManifest.xml in .apk files

## rails_dynamic_render_code_exec.rb
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  @@trav_string = '%5c%2e%2e%2f'

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,

## xssdetect.js
var page = require('webpage').create(),
    system = require('system'),
    address;

page.onInitialized = function () {
    page.evaluate(function () {
        // additional detection code here perhaps
        // f.e. detecting STORED/DOM XSS

    });

## solve.py
from scryptos import *

p1 = 32581479300404876772405716877547
p2 = 27038194053540661979045656526063
p3 = 26440615366395242196516853423447
n = p1*p2*p3
e = 3

c = int(open("flag.enc", "rb").read().encode("hex"), 16)
	<html>
	<head>
	<!--
	CVE-2014-6332 PoC to get meterpreter shell or bypass IE protected mode
	- Tested on IE11 + Windows 7 64-bit

	References:
	- original PoC - http://www.exploit-db.com/exploits/35229/
	- http://blog.trendmicro.com/trendlabs-security-intelligence/a-killer-combo-critical-vulnerability-and-godmode-exploitation-on-cve-2014-6332/
	- http://security.coverity.com/blog/2014/Nov/eric-lippert-dissects-cve-2014-6332-a-19-year-old-microsoft-bug.html
	import java.io.FileInputStream;
	import java.io.FileNotFoundException;
	import java.io.IOException;
	import java.io.InputStream;
	import java.util.zip.ZipEntry;
	import java.util.zip.ZipFile;

	class AndroidXMLDecompress {
	// decompressXML -- Parse the 'compressed' binary form of Android XML docs
	// such as for AndroidManifest.xml in .apk files
	require 'msf/core'

	class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking
	@@trav_string = '%5c%2e%2e%2f'

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
	super(update_info(info,
	var page = require('webpage').create(),
	system = require('system'),
	address;

	page.onInitialized = function () {
	page.evaluate(function () {
	// additional detection code here perhaps
	// f.e. detecting STORED/DOM XSS

	});
	from scryptos import *

	p1 = 32581479300404876772405716877547
	p2 = 27038194053540661979045656526063
	p3 = 26440615366395242196516853423447
	n = p1p2p3
	e = 3

	c = int(open("flag.enc", "rb").read().encode("hex"), 16)