Skip to content

Instantly share code, notes, and snippets.

View pial-vai's full-sized avatar

farhan nadim pial pial-vai

7 followers · 27 following
View GitHub Profile
@Homer28
Homer28 / test_dll.c
Last active May 17, 2024 12:37
DLL code for testing CVE-2024-21378 in MS Outlook
/**
* This DLL is designed for use in conjunction with the Ruler tool for
* security testing related to the CVE-2024-21378 vulnerability,
* specifically targeting MS Outlook.
*
* It can be used with the following command line syntax:
* ruler [auth-params] form add-com [attack-params] --dll ./test.dll
* Ruler repository: https://github.com/NetSPI/ruler/tree/com-forms (com-forms branch).
*
* After being loaded into MS Outlook, it sends the PC's hostname and
@ounissi-zakaria
ounissi-zakaria / postMessageTracker.js
Created March 22, 2024 21:08
User Script that tracks postMessage event listeners and makes it easy to track/debug them
// ==UserScript==
// @name PostMessage Tracker
// @namespace Violentmonkey Scripts
// @match *://*/*
// @version 1.0
// @author Ounissi zakaria (https://twitter.com/zakaria_ounissi)
// @description Each time an event listener is added for `message` it adds a menu command to tha message handler.
// @grant GM.registerMenuCommand
// @run-at document-start
// ==/UserScript==
@Dump-GUY
Dump-GUY / hint_calls.py
Created March 18, 2024 07:30
Modified version of Willi Ballenthin IDA Plugin hint_calls.py ported to support Python2/3 and IDA>=7.4 (tested IDA 7.7, 8.4)
'''
IDA plugin to display the calls and strings referenced by a function as hints.
Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <william.ballenthin@fireeye.com>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils
@Ry0taK
Ry0taK / condition.md
Last active April 7, 2024 18:19
Can we execute arbitrary JavaScript with these conditions?

Demo site

https://is-xss-possible.pages.dev/

Problem

(Please note that this problem might be unresolvable, as it's a real-world one.)

I encountered the following JavaScript in the real world (this is the simplified version):

const obj = {};
@GrayHatGuy
GrayHatGuy / iridium-sdr.md
Last active May 9, 2024 15:19
Iridium satellite cheat sheet for hackrf SDR capture using gr-iridium iridium-toolkit and iridium live

Description

This details how to capture voice text and rings associated with iridium satellite rebroadcasts of the Aircraft Communications Addressing and Report System (ACARS)

Prerequisites:

  • Start installation in home directory preferred 
    cd ~
  • Install the following repos preferably from source or using apt in home directory or /usr/scr/:
@MiloTruck
MiloTruck / Blast.md
Last active March 29, 2024 15:29
@pial-vai
pial-vai / 1_top+hacker_methodologies.md
Created January 7, 2024 18:37 — forked from ruevaughn/1_top+hacker_methodologies.md
Hacker Methodologies & Tools (NEW)

The Top Hacker Methodologies & Tools Notes

By Chase. ** *

Nuclei Templates

Concrete5 CMS : Identification, Mass Hunting, Nuclei Template Writing & Reporting

@arkark
arkark / README.md
Last active December 31, 2023 07:42
ASIS CTF Finals 2023
@testanull
testanull / SharePwn_public.py
Created December 15, 2023 07:31
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC
# -*- coding: utf-8 -*-
import hashlib
import base64
import requests, string, struct, uuid, random, re
import sys
from collections import OrderedDict
from sys import version
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
# too lazy to deal with string <-> bytes confusion in python3 so forget it ¯\_(ツ)_/¯
@paj28
paj28 / index.md
Last active April 21, 2024 16:26

Unicode XSS via Combining Characters

Most application security practitioners are familiar with Unicode XSS, which typically arises from the Unicode character fullwidth-less-than-sign. It’s not a common vulnerability but does occasionally appear in applications that otherwise have good XSS protection. In this blog I describe another variant of Unicode XSS that I have identified, using combining characters. I’ve not observed this in the wild, so it’s primarily of theoretical concern. But the scenario is not entirely implausible and I’ve not otherwise seen this technique discussed, so I hope this is useful.

Recap of Unicode XSS

Lab: https://4t64ubva.xssy.uk/

A quick investigation of the lab shows that it is echoing the name parameter, and performing HTML escaping: