wb4r wb4r

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

	<!DOCTYPE html>
	<html lang="en" dir="ltr">
	<head>
	<meta charset="utf-8">
	<title>cobalt</title>
	</head>
	<body>
	<h1>test</h1>
	<script type="text/javascript">
	window.onload = function(){

	<?xml version="1.0" encoding="ISO-8859-1"?>
	<!DOCTYPE foo [
	<!ELEMENT foo ANY >
	<!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo>

	#!/bin/bash


	USERNAME=$1
	# Only reads 200 for now. Havent implemented token + page iteration to extend this
	# Show repo name when showing findings
	# display help/usage
	# display need of install pip install gittyleaks => pip list --format=legacy \| grep -F gittyleaks
	# AND trufflehog => pip install truffleHog

	[
	{
	"city": "New York",
	"growth_from_2000_to_2013": "4.8%",
	"latitude": 40.7127837,
	"longitude": -74.0059413,
	"population": "8405837",
	"rank": "1",
	"state": "New York"
	},

	[
	{
	"city": "New York",
	"growth_from_2000_to_2013": "4.8%",
	"latitude": 40.7127837,
	"longitude": -74.0059413,
	"population": "8405837",
	"rank": "1",
	"state": "New York"
	},

	# Original project at https://github.com/psychomario/pyinject
	# The project is licensed under the terms of the MIT license; see
	# accompanying LICENSE.md for details.

	import ctypes
	import ctypes.wintypes as wintypes

	wintypes.LPTSTR = ctypes.POINTER(ctypes.c_char)
	wintypes.LPBYTE = ctypes.POINTER(ctypes.c_ubyte)
	wintypes.HANDLE = ctypes.c_void_p

	[0] FIND / GREP
	notes-w1.txt
	[*] FIND
	- Depth
	$ find . -maxdepth 1
	- Find and then copy (exec)
	$ ... -exec cp {} /home/caine/etccopy/ \;
	- Size:
	c (bytes)
	k (kilobytes)

	window.onload = function(){
	alert("COBALT XSS")
	};