Skip to content

Instantly share code, notes, and snippets.

@h121h
h121h / nowafpls___8KB.json
Created May 27, 2024 15:27 — forked from Rhynorater/nowafpls___8KB.json
nowafpls - Caido Convert Workflow
{
"description": "Bypass WAFs with 8KB Padding.",
"edition": 2,
"graph": {
"edges": [
{
"source": {
"exec_alias": "exec",
"node_id": 2
},
@h121h
h121h / Get_Early_Stargazers.graphql
Created January 4, 2022 00:12 — forked from nil0x42/Get_Early_Stargazers.graphql
[OSINT] Get early stargazers of a GitHub repository for org/user info gathering
# Get_Early_Stargazers #OSINT #recon trick, by @nil0x42
# Get list of first people to star a GitHub repository.
# Those are more likely to be closely connected to target org/user
# Run this query with wanted owner/name in GitHub GraphQL explorer:
# - https://developer.github.com/v4/explorer/
query Get_Early_Stargazers {
repository(owner: "sherlock-project", name: "sherlock") {
@h121h
h121h / st8out.sh
Created February 22, 2020 21:28 — forked from dwisiswant0/st8out.sh
St8out - Extra one-liner for reconnaissance
#!/bin/bash
#####
#
# St8out - Extra one-liner for reconnaissance
#
# Usage: ./st8out.sh target.com
#
# Resources:
# - https://github.com/j3ssie/metabigor
import requests
import re
import sys
from multiprocessing.dummy import Pool
def robots(host):
r = requests.get(
'https://web.archive.org/cdx/search/cdx\
?url=%s/robots.txt&output=json&fl=timestamp,original&filter=statuscode:200&collapse=digest' % host)
import requests
import sys
import json
def waybackurls(host, with_subs):
if with_subs:
url = 'http://web.archive.org/cdx/search/cdx?url=*.%s/*&output=json&fl=original&collapse=urlkey' % host
else:
url = 'http://web.archive.org/cdx/search/cdx?url=%s/*&output=json&fl=original&collapse=urlkey' % host
@h121h
h121h / .sql
Created December 13, 2017 19:44
* dumb split on first : * dumb convert any unknown utf-8 to surrogates and replace * can re-run on db if db has unique constraint on user&pass tuple
CREATE DATABASE pw
WITH
OWNER = XXXXXXXXXXXXXX
ENCODING = 'UTF8'
LC_COLLATE = 'en_US.UTF-8'
LC_CTYPE = 'en_US.UTF-8'
TABLESPACE = pg_default
CONNECTION LIMIT = -1;
CREATE TABLE public.passwords

How to pass the OSCP

  1. Recon
  2. Find vuln
  3. Exploit
  4. Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.