Skip to content

Instantly share code, notes, and snippets.

View skooch's full-sized avatar
💬
turn failure into knowledge, and avoid future stupidity.

skooch skooch

💬
turn failure into knowledge, and avoid future stupidity.
34 followers · 129 following
View GitHub Profile
@UniIsland
UniIsland / SimpleHTTPServerWithUpload.py
Created August 14, 2012 04:01
Simple Python Http Server with Upload
#!/usr/bin/env python
"""Simple HTTP Server With Upload.
This module builds on BaseHTTPServer by implementing the standard GET
and HEAD requests in a fairly straightforward manner.
"""
@kachayev
kachayev / concurrency-in-go.md
Last active May 31, 2024 09:34
Channels Are Not Enough or Why Pipelining Is Not That Easy
@CTurt
CTurt / gist:27fe7f3c241f69be19e5
Created December 14, 2015 19:24
PS4 kernel exploit tease (root FS dump, and list of PIDs)
[+] Entered shellcode
[+] UID: 0, GID: 0
[DIR]: .
[DIR]: ..
[DIR]: adm
[DIR]: app_tmp
[DIR]: data
[DIR]: dev
[DIR]: eap_user
[DIR]: eap_vsh
@tzmartin
tzmartin / ipsw.decrypt.md
Created January 12, 2016 17:55
Decrypting ipsw firmware files
@skahack
skahack / index.html
Created January 22, 2016 08:37
iOS 9 Safari - workaround
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Viewport Test</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<script src="/workaround.js"></script>
</head>
<body>
@edwinfinch
edwinfinch / 2070 Paradigm Shift Transcript
Last active May 19, 2024 13:57
2070 Paradigm Shift Transcript
Transcribed by Edwin Finch
Sam, you're a legend. Enjoy
==============================
Whew.
Hey.
@fincham
fincham / libpam-script_twilio
Last active August 7, 2017 10:37
#!/bin/bash
# Send a Twilio SMS when a person logs in over SSH or uses sudo. Michael Fincham <michael@hotplate.co.nz> 2017-05-22
#
# For a Debian host:
# - Install the packages for libpam-script and curl
# - Edit this script to set the configuration variables, and place it in /usr/share/libpam-script/pam_script_acct
# - Add this line to /etc/pam.d/common-account:
# account optional pam_script.so
@marcan
marcan / smbloris.c
Last active November 22, 2022 08:32
SMBLoris attack proof of concept
/* SMBLoris attack proof-of-concept
*
* Copyright 2017 Hector Martin "marcan" <marcan@marcan.st>
*
* Licensed under the terms of the 2-clause BSD license.
*
* This is a proof of concept of a publicly disclosed vulnerability.
* Please do not go around randomly DoSing people with it.
*
* Tips: do not use your local IP as source, or if you do, use iptables to block
@EdOverflow
EdOverflow / github_bugbountyhunting.md
Last active June 23, 2024 20:29
My tips for finding security issues in GitHub projects.

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output
@klmitchell2
klmitchell2 / gist:536bce0cec94d24a5799ba3b17499b54
Last active October 10, 2018 05:32
bfinject
#!/jb/bin/bash
CYCRIPT_PORT=1337
function help {
echo "Syntax: $0 [-p PID | -P appname] [-l /path/to/yourdylib | -L feature]"
echo
echo For example:
echo " $0 -P Reddit.app -l /path/to/evil.dylib # Injects evil.dylib into the Reddit app"
echo " or"