Search Results

Selecting JSON Properties Property Name Contains Dashes { "first-name": "john", "last-name": "doe", "nickname": "jim" } file.json jq ."first-name" < file.json Incorrect jq '."first-name"' < file.json Correct Select a Property from an Ar...

JVM Options Search for the application and right click "Edit Application" (KDE Plasma pictured)   Specify -XX:MaxRamPercentage= in the "Arguments" input (again KDE Plasma) Now, when Burp is launched, the Java VM options will constrain the process to us...

nano ~/.config/kwalletrc [Wallet] Enabled=false

openssl pkcs12 -export -out file.pfx -inkey file.key -in file.crt Enter password details when prompted

Cracking PFX Archives A .pfx archive is a way to bundle the certificate, key, and metadata in one container. There are ways to unbundle the archive and output the data into their individual parts. However, .pfx files are typically password protected, and woul...

Problem On Debian based systems, apt acts as a wrapper around dpkg to manage dependencies and conflicts when installing and removing an application. You have a binary installed on your system and you want to trace down which package installed this binary (as...

Problem On Debian based systems, apt acts as a wrapper around dpkg to manage dependencies and conflicts when installing and removing an application. You want to know which packages are going to be installed by a particular package when using apt. Solution...

When to Use You'll know when you've found a domain controller, because it will have several ports open that clearly distinguish it: PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn ...

sudo apt install pyenv pyenv init Sample output, run locally and append lines as described to your shell .rc file exec "$SHELL" Reload your shell .rc file pyenv install 3.11.11 Install python3.11 binaries mkdir ./python_project cd ./python_project p...

Brute Force Logins Brute Force with a Request File Start Burp Make a randomized login to the target web page Copy the output, for example: POST /login HTTP/1.1 Host: 10.10.10.10 Content-Length: 37 Accept: application/json, text/plain, */* User-Age...

Virtual Host Enumeration You can find a more detailed analysis on the functionality of virtual hosts here, whereas below is a very succinct overview of the configuration. Example Virtual Host Configs Nginx Virtual Hosts Example /etc/nginx/sites-available...

Network Diagram igb0 -- WAN [FIREWALL] igb1 -- LAN | igb1.25 | igb1.80 | igb1.148 | igb1.666 ...

Stored / Hosted XSS If the target page has a loose content security policy / cross-origin policy, then you may be able to host xss.js using a Python web server and have the target execute the JavaScript to read the page source stored in url. If there is a vul...

Stored / Hosted XSS If there is a vulnerability where you can store or submit HTML and have it rendered on the page or some other client-side application, then the src=x condition would trigger the onerror= attribute and cause the target to execute the JavaSc...

apple banana pear mango grapes fruit.txt cat fruit.txt | paste -s -d ',' - Using piped input paste -s -d ',' < fruit.txt Using data redirection  

https://mywiki.wooledge.org/BashPitfalls/ also on Archive.org Command execution via unquoted variable Arithmetic expansion leading to command execution Arithmetic expansion in array index leads to command execution Etc...

Assuming you have some means of reading server-side files, these are some examples of places you might look to find build manifests. Using local file read, we read ../../../../../../../../../proc/self/environ and find the Next.js application is Dockerized. W...

$searchPath = 'C:\Program Files' $userName = 'john.doe' Get-ChildItem -ErrorAction 'SilentlyContinue' -Force -File -Recurse -Path "$searchPath" | Where-Object { try { (Get-Acl $_.FullName).Owner -like "*$userName*" } catch {} }