Dominique RIGHETTO righettod

## poc_clear-site-data_header.php
<?php
//Local command to run example: "php -S localhost:8000"
//Get optional action: login / logout / random
$action="NA";
if (isset($_GET["a"])) {
    $action=$_GET["a"];
}
switch ($action) {
    //Login action fill session and local storage dummy data
    case "login":

## venom_security_tests_suite.yml
name: Security authorization test suites
# HOME: https://github.com/ovh/venom
# TEST API: https://gorest.co.in/
vars:
  target_host: ""
testcases:
- name: GetUserFromCollection
  steps:
  - type: http
    method: GET

## poc_uuidv1_sandwich_attack.py
import uuid
import binascii
from datetime import datetime

"""
Python3 script trying to reproduce the "Sandwich Attack: A New Way Of Brute Forcing UUIDs"
described on "https://versprite.com/blog/universally-unique-identifiers/".
"""


## odc_report.py
"""
Script was migrated below for better evolution and consistency:
https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/generate-report-odc.py
"""

## zipslip_validation.php
<?php
/**
 * Function to validate that a ZIP file do not contains "ZIP SLIP" payload entries.
 * @param string $zipFilePath Path to the ZIP to test.
 * @return bool TRUE only if the archive do not contains ZIP SLIP payload entries.
 * @link https://snyk.io/research/zip-slip-vulnerability
 * @link https://stackoverflow.com/a/3599093/451455 (inspired from)
 */
function isZipValid($zipFilePath){
    $isValid = false;

## keychain_data_persistence_mstg_check.py
import json
import binascii
import hashlib
import argparse
from tabulate import tabulate

"""
Python3 script to find common entries in 2 export of a iOS device keychain performed via objection.

The objective is to help performing the following test of the OWASP MSTG:

## ios-detect-screen-capture-and-screen-recording.swift
import UIKit

//Inspired from the code below:
//https://github.com/takashings/ScreenCapturedSample/blob/master/ScreenCapturedSample/ForScreenCapturedViewController.swift
//https://www.hackingwithswift.com/example-code/uikit/how-to-detect-when-the-user-takes-a-screenshot
@UIApplicationMain
class AppDelegate: UIResponder, UIApplicationDelegate {

    func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
        //Define a listener to handle the case when a screen recording is launched

## retirejs_report.py
"""
Script was migrated below for better evolution and consistency:
https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/generate-report-retirejs.py
"""

## Android-Utils.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                righettod
                / Android-Utils.md
            
            
              Last active
              January 2, 2020 09:31
            
              
                Utility PowerShell module when manipulating APK on Windows
              
          
    The code has been transformed to the following project

  
## pdf_metadata_cleanup.md

      
              1 file
            
          
              1 fork
            
          
              6 comments
            
          
              2 stars
            
          
                righettod
                / pdf_metadata_cleanup.md
            
            
              Last active
              May 23, 2023 14:21
            
              
                Java and C# code to cleanup the metadata from a PDF document.
              
          
    Code sample

All librairies used are free and open source.
Java

/* 
  See https://pdfbox.apache.org 
  See https://mvnrepository.com/artifact/org.apache.pdfbox/pdfbox for released artifacts
	<?php
	//Local command to run example: "php -S localhost:8000"
	//Get optional action: login / logout / random
	$action="NA";
	if (isset($_GET["a"])) {
	$action=$_GET["a"];
	}
	switch ($action) {
	//Login action fill session and local storage dummy data
	case "login":
	name: Security authorization test suites
	# HOME: https://github.com/ovh/venom
	# TEST API: https://gorest.co.in/
	vars:
	target_host: ""
	testcases:
	- name: GetUserFromCollection
	steps:
	- type: http
	method: GET
	import uuid
	import binascii
	from datetime import datetime

	"""
	Python3 script trying to reproduce the "Sandwich Attack: A New Way Of Brute Forcing UUIDs"
	described on "https://versprite.com/blog/universally-unique-identifiers/".
	"""
	"""
	Script was migrated below for better evolution and consistency:
	https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/generate-report-odc.py
	"""
	<?php
	/**
	* Function to validate that a ZIP file do not contains "ZIP SLIP" payload entries.
	* @param string $zipFilePath Path to the ZIP to test.
	* @return bool TRUE only if the archive do not contains ZIP SLIP payload entries.
	* @link https://snyk.io/research/zip-slip-vulnerability
	* @link https://stackoverflow.com/a/3599093/451455 (inspired from)
	*/
	function isZipValid($zipFilePath){
	$isValid = false;
	import json
	import binascii
	import hashlib
	import argparse
	from tabulate import tabulate

	"""
	Python3 script to find common entries in 2 export of a iOS device keychain performed via objection.

	The objective is to help performing the following test of the OWASP MSTG:
	import UIKit

	//Inspired from the code below:
	//https://github.com/takashings/ScreenCapturedSample/blob/master/ScreenCapturedSample/ForScreenCapturedViewController.swift
	//https://www.hackingwithswift.com/example-code/uikit/how-to-detect-when-the-user-takes-a-screenshot
	@UIApplicationMain
	class AppDelegate: UIResponder, UIApplicationDelegate {

	func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
	//Define a listener to handle the case when a screen recording is launched