Web Code Snippets

Reusable exploit-script foundations: argument parsing, requests sessions, response validation, Boolean oracles, and command loops.

Sending requests the way a target expects them: query params, form and JSON bodies, multipart uploads, cookies, bearer tokens, and CSRF flows.

Extracting values from HTML, structured responses, generated files, and command output surrounded by markers.

Pulling values out of text with regular expressions: capturing between fixed markers, non-greedy multiline capture with re.DOTALL, and collecting every match with findall.

Base64, URL, octal, hex and HTML codecs, nested payload strings, and JWT decode, tampering, and forge.

Common transformations, random value generators, and file operations used across exploit scripts.

Running blocking commands and retaining handles to long-running background processes.

Synchronous and asyncio WebSocket clients, and a blind oracle that drives extraction over a single socket.

Concurrent request execution for race conditions and finite-keyspace brute force.

Background HTTP servers, callback capture, request-log parsing, and Ngrok and Cloudflare tunnels.

Runtime inspection for containerized applications through VS Code or the command line.

Framework and runtime behavior that affects exploit development.

Hosted callback exfiltration with webhook.site: create inboxes, send command output, and poll captured data.

A reverse-shell listener that binds before the exploit trigger, waits for the callback, and opens an interactive session.

Building and reading ZIP and TAR files, including Zip-Slip and symlink-traversal archives.

End-to-end skeletons for SSRF scans, second-order injection, cache poisoning, renderer file reads, and arbitrary file write to hot-reload RCE.

Dialect-specific SQL injection testing, blind extraction, and database execution primitives for H2, MSSQL, MySQL, PostgreSQL, and SQLite.

Operator and $regex boolean-blind exfiltration, server-side JavaScript injection, and time-based oracles for NoSQL backends.

XPath injection in Python: authentication bypass, in-band node dumping, and boolean and time-based blind extraction.

Boolean-blind LDAP injection: bruteforcing a password and dumping arbitrary attributes one character at a time.

Validation bypasses caused by regex anchors and multiline input.

Server-side PHP, Python, and JavaScript code injection: manual source review, in-band output, blind oracles, and parser-specific bypasses.

Repeated HTTP parameters interpreted differently across frontend and backend parsers.

Node.js prototype-pollution payload shapes and child_process sink gadgets.

Unsafe Java, PHP, and Python deserialization discovery, object lifecycle behavior, reconstruction hooks, gadget review, and payload generation.

Server-side LaTeX injection for local file read, including TeX hexadecimal notation for restricted input.

Server-side template injection testing and exploitation for Jinja2, Nunjucks, JsRender, Pug, Velocity, Thymeleaf, and Go html/template.

Blind command injection with out-of-band exfiltration and an ${IFS} space-filter bypass.

Browser-side data exfiltration through an HTTP callback.

Cross-origin browser side channels that turn resource-loading behavior into Boolean oracles.