Naveen Jagadeesan thevillagehacker

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

This is a simple guide to perform javascript recon in the bugbounty

The first step is to collect possibly several javascript files (more files = more paths,parameters -> more vulns)

	setTimeout(function(){
	Java.perform(function (){
	console.log("[*] Script loaded")
	var MenuActivity = Java.use("sg.vantagepoint.mstgkotlin.MenuActivity")
	StartActivity.RootDetection.overload().implementation = function() {
	console.log("[*] isDeviceRooted function invoked")
	return false
	}
	console.log("");
	console.log("[.] Cert Pinning Bypass/Re-Pinning");

	/*
	Android SSL Re-pinning frida script v0.2 030417-pier

	$ adb push burpca-cert-der.crt /data/local/tmp/cert-der.crt
	$ frida -U -f it.app.mobile -l frida-android-repinning.js --no-pause

	https://techblog.mediaservice.net/2017/07/universal-android-ssl-pinning-bypass-with-frida/

	UPDATE 20191605: Fixed undeclared var. Thanks to @oleavr and @ehsanpc9999 !
	*/

	# Basic Usage
	ffuf -w wordlist.txt -u http://127.0.0.1:8000/api/FUZZ/6 -o output.txt -replay-proxy http://127.0.0.1:8080

	# Basic Usage With a Cookie
	ffuf -w wordlist.txt -u http://127.0.0.1:8000/api/FUZZ/6 -o output.txt -replay-proxy http://127.0.0.1:8080 -b "laravel_session=eyJpdiI6Ii8wQU11dTVlUkg2alRHUXBIVzlGSnc9PSIsInZhbHVlIjoiOWs3YllJWTdqNC9xa1pMeFRvMFh0OE1vRFpaWm9GSzFkRktVZS9yUHBDM0lIazZ4K0NsbndxWVIxQ05VZWhqZUZaR0RGQWlFdmdDc24yWllYRklGSXI5STd2b05Pam4yRXIwV1BUWkZhUnFLNUFzOWsycmRHcnlxS0FqRWNsSnEiLCJtYWMiOiI3ZTliMmM2YzIxOTExNDE0NmVjYTYyMGI4Nzg4YzJiYjNmNjVkNDI1YzEyODYwMzY5YzczNzY3NTUwZDk0OGYzIn0%3D;"

	# Adding a delay
	ffuf -w wordlist.txt -u http://127.0.0.1:8000/api/FUZZ/6 -o output.txt -replay-proxy http://127.0.0.1:8080 –p 1 –t 3

	# Adding a delay (new method)