Skip to content

Instantly share code, notes, and snippets.

View abdulsec's full-sized avatar

abdulsec abdulsec

18 followers · 207 following
View GitHub Profile
@abdulsec
abdulsec / Filename extension list
Created September 22, 2023 00:58 — forked from securifera/Filename extension list
.php
.html
.txt
.htm
.aspx
.asp
.js
.css
.pgsql.txt
.mysql.txt
@abdulsec
abdulsec / My Manjaro Linux (GNOME) Web Development Environment Setup.md
Created April 21, 2022 07:13 — forked from calebklc/My Manjaro Linux (GNOME) Web Development Environment Setup.md
My Manjaro Linux (GNOME) Web Development Environment Setup
@abdulsec
abdulsec / phpdangerousfuncs.md
Created January 10, 2022 04:23 — forked from mccabe615/phpdangerousfuncs.md
Dangerous PHP Functions

Command Execution

exec           - Returns last line of commands output
passthru       - Passes commands output directly to the browser
system         - Passes commands output directly to the browser and returns last line
shell_exec     - Returns commands output
\`\` (backticks) - Same as shell_exec()
popen          - Opens read or write pipe to process of a command
proc_open      - Similar to popen() but greater degree of control
pcntl_exec - Executes a program
@abdulsec
abdulsec / bbprograms.txt
Created June 23, 2021 19:18 — forked from haxcited/bbprograms.txt
google dork -> site:.co.uk inurl:"responsible disclosure"
https://registry.internetnz.nz/about/vulnerability-disclosure-policy/
http://www.123contactform.com/security-acknowledgements.htm
https://18f.gsa.gov/vulnerability-disclosure-policy/
https://support.1password.com/security-assessments/
https://www.23andme.com/security-report/
https://www.abnamro.com/en/footer/responsible-disclosure.html
https://www.accenture.com/us-en/company-accenture-responsible-disclosure
https://www.accredible.com/white_hat/
https://www.acquia.com/how-report-security-issue
@abdulsec
abdulsec / cluster.py
Created June 20, 2021 13:44 — forked from defparam/cluster.py
Gist of the Day: Turbo Intruder Cluster Bomb with SmartFiltering
# Gist of the Day: Turbo Intruder Cluster Bomb with SmartFiltering
# Author: Evan Custodio (@defparam)
#
# MIT License
# Copyright 2021 Evan Custodio
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
#
@abdulsec
abdulsec / api_wordlist.txt
Created May 3, 2021 08:45 — forked from Uyavuz24/api_wordlist.txt
api wordlist
/2
/graphql-proxy/admin
/3.0/
/3ds_callback
/3ds_update_payment_callback
/accounts
/active
/activity
/actuator
/actuator/auditevents
@abdulsec
abdulsec / introspection-query.graphql
Created March 2, 2021 22:37 — forked from craigbeck/introspection-query.graphql
Introspection query for GraphQL
query IntrospectionQuery {
__schema {
queryType { name }
mutationType { name }
subscriptionType { name }
types {
...FullType
}
directives {
@abdulsec
abdulsec / short-wordlist.txt
Created February 16, 2021 04:08 — forked from tomnomnom/short-wordlist.txt
short-wordlist
/.s3cfg
/phpunit.xml
/nginx.conf
/.vimrc
/LICENSE.md
/yarn.lock
/Gulpfile
/Gulpfile.js
/composer.json
/.npmignore
@abdulsec
abdulsec / JavascriptRecon.md
Created January 21, 2021 04:51
My Javascript Recon Process - BugBounty

Description

This is a simple guide to perform javascript recon in the bugbounty

Steps

  • The first step is to collect possibly several javascript files (more files = more paths,parameters -> more vulns)
@abdulsec
abdulsec / cloud_metadata.txt
Created January 21, 2021 03:35 — forked from jhaddix/cloud_metadata.txt
Cloud Metadata Dictionary useful for SSRF Testing
## AWS
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key