nil0x42

#!/bin/bash
# by @nil0x42

shuf IP-LIST.TXT > /tmp/ips.txt # randomize ip-list
# for each port (in random order):
for i in {1..65535}; do echo $i; done | shuf | while read port; do
    # scan single port on every IP from randomized ip-list
    nmap -sS -PN -n --max-retries=0 --max-rtt-timeout=1000ms \
        --min-rate=10000 --min-hostgroup=4096 -iL /tmp/ips.txt -p $port
done

nil0x42

# usage: atomicwrite_ifchanged output.txt
#   - overwrite atomically (mv)
#   - only writes to the file if new content is different
# by @nil0x42
function atomicwrite_ifchanged() {
    test "$#" -eq 1 # ARGC == 1
    test ! -t 0 # STDIN not a TTY
    local file="$1"
    local tmp_file="$(mktemp "${file}.XXXXXX.atomicwrite_ifchanged.part")"
    cat - >| "$tmp_file"

nil0x42

import struct
import socket

class SubnetList:
    """Quickly check if an IPv4 is contained in a list of subnets.
    - by @nil0x42
    - inspired by @nigel222's solution: https://stackoverflow.com/a/44264136
    >>> cloudflare_ips = SubnetList("/wordlists/cloudflare-ips.txt")
    >>> "103.31.4.12" in cloudflare_ips
    True

nil0x42

# Safe lock-based `anew` wrapper for concurrent usage.
# e.g: gau tesla.com | anew_safe ~/tesla/endpoints.txt
function anew_safe() {
    [ -t 0 ] && exit 1 # STDIN not a TTY
    [[ "$1" == "-q" ]] && file="$2" || file="$1"
    {
        flock -x 200
        cat - | anew "$@"
    } 200>>"$file"
}

nil0x42

#!/usr/bin/env python3

#author: @nil0x42
# Usage:
#   $ export GITHUB_TOKEN="<YOUR GITHUB TOKEN>"
#   $ cat github-users.txt | ./gist-massdump.py
#   $ grep -r 'someSecret' gist-massdump.out/
import sys, os, requests, json, pathlib

if sys.stdin.isatty():

nil0x42

#!/usr/bin/python3 -u
# requirements: PyCryptodome

import base64
import subprocess
from Crypto.Util.strxor import strxor
from Crypto.Util.Padding import pad

### variables to set
PLAINTEXT = b"id=12345678;name=myname;is_admin=false;mail=mymail@mail.com"

nil0x42

https://secapps.com/ https://bountyhq.secapps.com/

https://bugbountyrecon.com/

https://projectdiscovery.io/

https://leakix.net/

https://findomain.app/

nil0x42

# extract top subdomains from your firefox history
# by @nil0x42

grep -Pao "https://[a-zA-Z0-9.-]+" ~/.mozilla/firefox/*/places.sqlite \
  | sort -u | sed 's#.*://\([a-zA-Z0-9-]*\)\..*#\1#' | uniq -c | sort -rn

nil0x42

Projects

https://github.com/TH3xACE/SUDO_KILLER

• Linux Privilege Escalation through SUDO abuse.

https://github.com/wintrmvte/Bashark

• Bashark aids pentesters and security researchers during the post-exploitation phase of security audit.

---

nil0x42

#!/usr/bin/env python3

# author: @nil0x42
# Usage example:
#   $ export GITHUB_TOKEN="<YOUR GITHUB TOKEN>"
#   $ ./get-githus-stargazers-twitter.py "rapid7/metasploit-framework"
import sys, os, requests, json

OWNER, REPO = sys.argv[1].split("/")
GH_TOKEN = os.environ.get("GITHUB_TOKEN")