Skip to content

Instantly share code, notes, and snippets.

View GilbertoTorres's full-sized avatar

GilbertoTorres

View GitHub Profile

You will need ssh access to your USG. I suggest running sudo su so you're the root user throughout

Installation

  1. Download tailscale and put the files in /config/. Find the latest stable or unstable version for your USG's processor.
curl https://pkgs.tailscale.com/stable/tailscale_1.36.1_mips64.tgz | tar xvz -C /tmp
mv /tmp/tailscale_1.36.1_mips64 /config/tailscale
gilbertotorres
### Keybase proof
I hereby claim:
* I am gilbertotorres on github.
* I am gilbertotorres (https://keybase.io/gilbertotorres) on keybase.
* I have a public key ASBTquMTPKCKk58HO8frwqzIyr_rHqsr9j9KqjK7TF2xrQo
To claim this, I am signing this object:
### Keybase proof
I hereby claim:
* I am gilbertotorres on github.
* I am gilbertotorres (https://keybase.io/gilbertotorres) on keybase.
* I have a public key ASBTquMTPKCKk58HO8frwqzIyr_rHqsr9j9KqjK7TF2xrQo
To claim this, I am signing this object:
@GilbertoTorres
GilbertoTorres / WAHH_Task_Checklist.md
Created May 3, 2019 08:25 — forked from jhaddix/Testing_Checklist.md
The Web Application Hacker's Handbook - Task Checklist - Github-Flavored Markdown
@GilbertoTorres
GilbertoTorres / content_discovery_all.txt
Created May 3, 2019 08:25 — forked from jhaddix/content_discovery_all.txt
a masterlist of content discovery URLs and files (used most commonly with gobuster)
This file has been truncated, but you can view the full file.
`
~/
~
ים
___
__
_
@GilbertoTorres
GilbertoTorres / all.txt
Created May 3, 2019 08:25 — forked from jhaddix/all.txt
all wordlists from every dns enumeration tool... ever. Please excuse the lewd entries =/
This file has been truncated, but you can view the full file.
.
..
........
@
*
*.*
*.*.*
🐎
@GilbertoTorres
GilbertoTorres / attributes.rb
Created April 26, 2019 13:58 — forked from lizthegrey/attributes.rb
Hardening SSH with 2fa
default['sshd']['sshd_config']['AuthenticationMethods'] = 'publickey,keyboard-interactive:pam'
default['sshd']['sshd_config']['ChallengeResponseAuthentication'] = 'yes'
default['sshd']['sshd_config']['PasswordAuthentication'] = 'no'
@GilbertoTorres
GilbertoTorres / gist:fb0993d3a9646da994462ddfad3ffa10
Created April 26, 2019 13:56 — forked from Viss/gist:e7c735ed389c8d055e6f31e845f25516
bash one liner for extracting shodan results for weblogic.
#!/bin/bash
# this script was written by viss as a challenge from @random_robbie
# This one-liner replaces a fairly lengthy python script
# if you want to be walked through it, sign up for square cash, send $viss 20 dollars. Otherwise, flex your google fu!
# oh, ps: you need to pip install shodan, and then configure the shodan cli client by giving it your api key.
# then you're off to the races.
shodan search --fields ip_str --limit 1000 'product:"Oracle Weblogic" port:"7001" country:"US"' | sort -u | nmap -sT -Pn -n -oG - -iL - -p 7001 | grep open | awk '{print $2}' | xargs -I % -n 1 -P 30 bash -c 'RESULT=`curl -s -I -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko0100101 Firefox/54.0" -H "Connection":"close" -H "Accept-Language":"en-US -H en;q=0.5" -H "Accept":"text/html -H application/xhtml+xml -H application/xml;q=0.9 -H */*;q=0.8" -H "Upgrade-Insecure-Requests":"1" %:7001/ws_utc/config.do | egrep HTTP`; echo "%: $RESULT";'
@GilbertoTorres
GilbertoTorres / fuzz.html
Created April 26, 2019 10:20 — forked from LiveOverflow/fuzz.html
Fuzz innerHTML vs. DOMParser
<html>
<body>
<script>
const tags = ["a", "abbr", "address", "area", "article", "aside", "audio", "b", "base", "bdi", "bdo", "blockquote", "body", "br", "button", "canvas", "caption", "cite", "code", "col", "colgroup", "data", "datalist", "dd", "del", "details", "dfn", "dialog", "div", "dl", "dt", "em", "embed", "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "iframe", "img", "input", "ins", "kbd", "keygen", "label", "legend", "li", "link", "main", "map", "mark", "math", "menu", "menuitem", "meta", "meter", "nav", "noscript", "object", "ol", "optgroup", "option", "output", "p", "param", "picture", "pre", "progress", "q", "rb", "rp", "rt", "rtc", "ruby", "s", "samp", "script", "section", "select", "slot", "small", "source", "span", "strong", "style", "sub", "summary", "sup", "svg", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "title", "tr", "track", "u", "ul", "var", "video", "wbr"]
@GilbertoTorres
GilbertoTorres / params.txt
Created April 26, 2019 10:17 — forked from nullenc0de/params.txt
List of parameters for content discovery
0
1
11
12
13
14
15
16
17
2