Google Dorks

Find instances of a string in a site site:techvomit.net intext:"penetration" Find all pdfs in a site site:tacticaltech.org filetype:pdf Resource: https://exposingtheinvisible.org/guides/google-dorking/ Search for emails in xlsx files intext:@<domain> filetype:xlsx Search for subdomain takeover reports on h1 site:hackerone.com intext:"subdomain takeover"

Jayson Grace

Google Search Analytic on a Ghost blog

Register site for google site verification and search analytics Go to https://search.google.com/search-console register your site Go to https://analytics.google.com to register your site Integrate ghost Using the UI: Go to /ghost/##/settings/code-injection Paste both codes into the Site Header Click Save Modifying ghost code: Go to your theme Open default.hbs Paste both codes under the <head> area Resource: https://www.youtube.com/watch?v=NaBlkYsx-tY Add disquis Go to your theme Open default.hbs Add the following under {{ghost_foot}}: {{##if post}} {{> disqus-post}} {{else}} {{> disqus-home}} {{/if}}

Jayson Grace

Handy Prompts

This is a collection of prompts I’ve written for projects in various languages that I work with on a regular basis. Setup There are some tools that I use with these prompts that you may want to add to your system by running the following commands: bashutils_url="https://raw.githubusercontent.com/l50/dotfiles/main/bashutils" bashutils_path="/tmp/bashutils" if [[ ! -f "${bashutils_path}" ]]; then curl -s "${bashutils_url}" -o "${bashutils_path}" fi source "${bashutils_path}" Next, navigate to the directory of the project you want to work on and run the following command:...

Jayson Grace

IDA Cheatsheet

Find a string Alt+b Once you’ve done this, be sure to encase the string you want to find in “”. For example: "string to find" Open breakpoints window Ctrl + Alt + b Preset breakpoints Click Debugger Debugger options… Set specific options Check the box next to preset BPTs Click OK Debug Android Activity Find an activity in a package that you want to look at Click Debugger -> Debugger options -> Set specific options...

Jayson Grace

Interfacing with Oracle DBs

This was so much of a pain in the ass to figure out that I decided that I would compile a whole post specifically around useful information for this topic. To get started, download SQLDeveloper through Oracle’s site (you’ll need to register). So far I’ve tested this on macOS. Establishing a connection Under the Connections tab, click the green plus button Specify Basic for the connection type Put in the Connection name, Username, Password, Hostname, and Port For SID, put in the hostname without the domain....

Jayson Grace

Javascript Cheatsheet

Loop through Array nodes = document.querySelectorAll('[id^=node]'); nodes.forEach((x, i) => x.dispatchEvent(new MouseEvent('mouseover', {'bubbles': true})));" Resource: https://stackoverflow.com/questions/3010840/loop-through-an-array-in-javascript Submit POST request without reloading page As an added bonus, this will also print the response output to the DOM. Do not run this in production - it has vulnerabilities in it. <!doctype html> <html lang="en"> <head> <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script> <script> $(document).ready(function () { // Create a compute node for the specified email and // return its public IP address....

Jayson Grace

Jira Cheatsheet

JQL Show tickets created by a user This will also show them in descending order, which will give you the most recently created issues first. reporter = <username> order by created DESC Query by project project = "Project Name" Find issues belonging to an inactive user reporter in (inactiveUsers()) Search via text text ~ "thing to search for" Searching for multiple criteria project = "Project Name" AND text ~ "something" Resource: https://community....

Jayson Grace

JQ Cheatsheet

Loop over JSON array This example will print all of the values associated with the name key: sample='[{"name":"foo"},{"name":"bar"}]' for row in $(echo "${sample}" | jq -r '.[] | @base64'); do echo ${row} | base64 --decode | jq -r '.name' done Resource: https://www.starkandwayne.com/blog/bash-for-loop-over-json-array-using-jq/ Get object based on value of JSON variable jq '.[] | select(.location=="Stockholm")' json { "location": "Stockholm", "name": "Walt" } { "location": "Stockholm", "name": "Donald" } Resource: https://stackoverflow.com/questions/18592173/select-objects-based-on-value-of-variable-in-object-using-jq Get keys of object jq 'keys' blob....

Jayson Grace

Kubernetes Cheatsheet

Kubectl Best alias ever alias k='kubectl' List everything in a particular namespace kubectl get all -n $NAMESPACE_NAME Resource: https://stackoverflow.com/questions/62240272/deleting-namespace-was-stuck-at-terminating-state Force delete a namespace If a namespace is stuck in the terminating state, you can run this to finish it: for ns in $(kubectl get ns --field-selector status.phase=Terminating -o jsonpath='{.items[*].metadata.name}') do kubectl get ns $ns -ojson | jq '.spec.finalizers = []' | kubectl replace --raw "/api/v1/namespaces/$ns/finalize" -f - done for ns in $(kubectl get ns --field-selector status....

Jayson Grace

Metasploit Cheatsheet

Setup the Database service postgresql start kali msfdb init Test it: msfconsole db_status You’ll know it worked if you see [*] postgresql connected to msf. Resource: https://docs.kali.org/general-use/starting-metasploit-framework-in-kali Troubleshooting database connectivity issues Start by restarting the postgres service: service postgresql restart If that doesn’t work, try destroying and recreating the database: msfdb delete msfdb init Then test it: msfconsole db_status Resource: https://stackoverflow.com/questions/32561760/metasploit-cant-use-default-msf3-to-connect Meterpreter Get current user info getuid View running jobs Useful if you’re running something with exploit -j -z...

Jayson Grace