Old poc examples were full of injections due to migration strategy. Will be rewritten in doc.
This commit is contained in:
Roberto Abdelkader Martínez Pérez
@@ -1,19 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
#
|
|
||||||
# Copyright 2019 Banco Bilbao Vizcaya Argentaria, S.A.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
|
|
||||||
kapow route add -X POST '/eval' -c '$($(kapow get /request/body) | kapow set /response/stream)'
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
#!/usr/bin/env sh
|
|
||||||
|
|
||||||
curl -X POST --data-binary @- http://localhost:8080/eval <<EOF
|
|
||||||
touch /tmp/kapow_was_here
|
|
||||||
EOF
|
|
||||||
|
|
||||||
echo 'Proof of success:'
|
|
||||||
ls -l /tmp/kapow_was_here
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
<!DOCTYPE html>
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<meta charset="UTF-8">
|
|
||||||
<title>Nmap</title>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<form id="nmap-params" method="post" action="nmap.xml">
|
|
||||||
<fieldset>
|
|
||||||
<legend>Nmap parameters</legend>
|
|
||||||
<div>
|
|
||||||
<label for="target_spec">Target Specification:</label>
|
|
||||||
<input name="target_spec" type="text" placeholder="ip, domain, network, range" value="127.0.0.1" required autofocus>
|
|
||||||
<p>
|
|
||||||
Can pass hostnames, IP addresses, networks, etc. e.g.:
|
|
||||||
scanme.nmap.org, microsoft.com/24, 192.168.0.1;
|
|
||||||
10.0.0-255.1-254
|
|
||||||
</p>
|
|
||||||
</div>
|
|
||||||
<div>
|
|
||||||
<label for="port_ranges">Port Ranges:</label>
|
|
||||||
<input name="port_ranges" type="text" placeholder="port, range, list" value="8080" required>
|
|
||||||
<p>
|
|
||||||
Only scan specified ports. e.g.: 22; 1-65535;
|
|
||||||
U:53,111,137,T:21-25,80,139,8080,S:9
|
|
||||||
</p>
|
|
||||||
</div>
|
|
||||||
<div>
|
|
||||||
<input name="scan" type="submit" value="Scan">
|
|
||||||
<input name="reset" type="reset" value="Reset">
|
|
||||||
</div>
|
|
||||||
</fieldset>
|
|
||||||
</form>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
#
|
|
||||||
# Copyright 2019 Banco Bilbao Vizcaya Argentaria, S.A.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
|
|
||||||
#
|
|
||||||
# Nmap produces an XML report, suitable for rendering in a web browser
|
|
||||||
#
|
|
||||||
|
|
||||||
# Call examples:
|
|
||||||
#
|
|
||||||
# $ browser http://localhost:8080
|
|
||||||
#
|
|
||||||
# $ curl -v http://localhost:8080/nmap.xml -d 'target_spec=127.0.0.1&port_ranges=9000'
|
|
||||||
#
|
|
||||||
|
|
||||||
kapow route add -X GET / - <<-'EOF'
|
|
||||||
cat nmap-web.html | kapow set /response/body
|
|
||||||
EOF
|
|
||||||
|
|
||||||
kapow route add -X GET /nmap.xsl - <<-'EOF'
|
|
||||||
curl --silent https://svn.nmap.org/nmap/docs/nmap.xsl \
|
|
||||||
| kapow set /response/body
|
|
||||||
EOF
|
|
||||||
|
|
||||||
kapow route add -X POST /nmap.xml - <<-'EOF'
|
|
||||||
|
|
||||||
TARGET_SPEC=$(kapow get /request/form/target_spec)
|
|
||||||
: ${TARGET_SPEC:=127.0.0.1}
|
|
||||||
|
|
||||||
PORT_RANGES=$(kapow get /request/form/port_ranges)
|
|
||||||
: ${PORT_RANGES:=8080}
|
|
||||||
|
|
||||||
nmap \
|
|
||||||
-Pn \
|
|
||||||
-n \
|
|
||||||
-p "$PORT_RANGES" \
|
|
||||||
-oX - \
|
|
||||||
--stylesheet /nmap.xsl \
|
|
||||||
"$TARGET_SPEC" \
|
|
||||||
| kapow set /response/body
|
|
||||||
EOF
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
FROM bbvalabsci/kapow:latest
|
|
||||||
|
|
||||||
RUN apk add nmap
|
|
||||||
|
|
||||||
COPY nmap.pow /tmp/
|
|
||||||
|
|
||||||
CMD ["server", "/tmp/nmap.pow"]
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
#
|
|
||||||
# Copyright 2019 Banco Bilbao Vizcaya Argentaria, S.A.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
|
|
||||||
kapow route add -X GET '/list/{ip}' -c 'nmap -sL "$(kapow get /request/matches/ip)" | kapow set /response/body'
|
|
||||||
@@ -1,41 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
#
|
|
||||||
# Copyright 2019 Banco Bilbao Vizcaya Argentaria, S.A.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
|
|
||||||
kapow route add /list/files -c 'ls -la $(kapow get /request/params/path) | kapow set /response/body'
|
|
||||||
|
|
||||||
kapow route add /list/processes -c 'ps -aux | kapow set /response/body'
|
|
||||||
|
|
||||||
kapow route add /show/cpuinfo -c 'kapow set /response/body < /proc/cpuinfo'
|
|
||||||
|
|
||||||
kapow route add /show/memory -c 'free -m | kapow set /response/body'
|
|
||||||
|
|
||||||
kapow route add /show/disk -c 'df -h | kapow set /response/body'
|
|
||||||
|
|
||||||
kapow route add /show/connections -c 'ss -pluton | kapow set /response/body'
|
|
||||||
|
|
||||||
kapow route add /show/mounts -c 'mount | kapow set /response/body'
|
|
||||||
|
|
||||||
kapow route add /tail/dmesg - <<-'EOF'
|
|
||||||
kapow set /response/headers/Content-Type text/plain
|
|
||||||
dmesg -w | kapow set /response/stream
|
|
||||||
EOF
|
|
||||||
|
|
||||||
kapow route add /tail/journal - <<-'EOF'
|
|
||||||
kapow set /response/headers/Content-Type text/plain
|
|
||||||
journalctl -f | kapow set /response/stream
|
|
||||||
EOF
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
#
|
|
||||||
# Copyright 2019 Banco Bilbao Vizcaya Argentaria, S.A.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
|
|
||||||
kapow route add -X POST --entrypoint '/bin/zsh -c' '/convert/{from}/{to}' - <<-'EOF'
|
|
||||||
pandoc --from="$(kapow get /request/matches/from)" \
|
|
||||||
--to="$(kapow get /request/matches/to)" \
|
|
||||||
--output=>(kapow set /response/body) \
|
|
||||||
=(kapow get /request/body)
|
|
||||||
EOF
|
|
||||||
kapow route add -X GET '/formats/input' -c 'pandoc --list-input-formats | kapow set /response/body'
|
|
||||||
kapow route add -X GET '/formats/output' -c 'pandoc --list-output-formats | grep -v pdf | kapow set /response/body'
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
#!/usr/bin/env sh
|
|
||||||
|
|
||||||
curl -X POST --data-binary @- http://localhost:8080/convert/markdown/man <<EOF
|
|
||||||
# This is not a pipe
|
|
||||||
|
|
||||||
1. hello
|
|
||||||
1. goodbye
|
|
||||||
EOF
|
|
||||||
@@ -1,41 +0,0 @@
|
|||||||
<html>
|
|
||||||
<head>
|
|
||||||
<title>PDF Editor</title>
|
|
||||||
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/siimple/dist/siimple.min.css">
|
|
||||||
<head>
|
|
||||||
<body>
|
|
||||||
<div class="siimple-content siimple-content--extra-large">
|
|
||||||
<div class="siimple-grid">
|
|
||||||
<div class="siimple-grid-row">
|
|
||||||
<div class="siimple-grid-col siimple-grid-col--12">
|
|
||||||
<div class="siimple-grid-col siimple-grid-col--6">
|
|
||||||
<div class="siimple-form">
|
|
||||||
<form action="/editor/pdf" method="post" target="result" id="editor">
|
|
||||||
<div class="siimple-form-title">AWYSIWYG PDF Editor</div>
|
|
||||||
<div class="siimple-form-field">
|
|
||||||
<div class="siimple-form-field-label">InputFormat</div>
|
|
||||||
<select name="from">
|
|
||||||
<option value="markdown">Markdown</option>
|
|
||||||
<option value="rst">ReStructuredText</option>
|
|
||||||
</select>
|
|
||||||
</div>
|
|
||||||
<div class="siimple-form-field">
|
|
||||||
<div class="siimple-form-field-label">InputFormat</div>
|
|
||||||
<textarea class="siimple-textarea siimple-textarea--fluid" rows="25" name="content">Example text</textarea>
|
|
||||||
</div>
|
|
||||||
<div class="siimple-form-field">
|
|
||||||
<div class="siimple-btn siimple-btn--blue" onclick="document.getElementById('editor').submit();">Preview!</div>
|
|
||||||
</div>
|
|
||||||
</form>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
<div class="siimple-grid-col siimple-grid-col--6">
|
|
||||||
<iframe name="result" src="" style="height: 100%; width: 100%;"></iframe>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
#
|
|
||||||
# Copyright 2019 Banco Bilbao Vizcaya Argentaria, S.A.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
|
|
||||||
kapow route add -X POST --entrypoint ./topdf '/editor/pdf'
|
|
||||||
kapow route add / -c 'kapow set /response/headers/Content-Type text/html && kapow set /response/body < pdfeditor.html'
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
#!/usr/bin/zsh
|
|
||||||
|
|
||||||
#
|
|
||||||
# Copyright 2019 Banco Bilbao Vizcaya Argentaria, S.A.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
|
|
||||||
tmpfile=$(mktemp --suffix=.pdf)
|
|
||||||
pandoc --from="$(kapow get /request/form/from)" --to=pdf --output=${tmpfile} -t latex =(kapow get /request/form/content)
|
|
||||||
if [ $? -eq 0 ]; then
|
|
||||||
kapow set /response/headers/Content-Type application/pdf
|
|
||||||
kapow set /response/body < ${tmpfile}
|
|
||||||
kapow set /response/status 200
|
|
||||||
else
|
|
||||||
kapow set /response/status 500
|
|
||||||
fi
|
|
||||||
rm -f ${tmpfile}
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
Remote tcpdump sniffer with source filtering
|
|
||||||
============================================
|
|
||||||
|
|
||||||
1. Add any filter you want to the `tcpdump` command inside `tcpdump.pow` to filter
|
|
||||||
any traffic you don't want to be sniffed!
|
|
||||||
2. For the sake of simplicity, run `sudo -E kapow server tcpdump.pow`. In a
|
|
||||||
production environment, `tcpdump` should be run with the appropiate permissions,
|
|
||||||
but kapow can (and should) run as an unprivileged user.
|
|
||||||
3. In your local machine run:
|
|
||||||
```bash
|
|
||||||
curl http://localhost:8080/sniff/<network-interface> | sudo -E wireshark -k -i -
|
|
||||||
```
|
|
||||||
Again, for the sake of simplicity, `Wireshark` is running as root. If you don't want
|
|
||||||
to run it this way, follow this guide:
|
|
||||||
https://gist.github.com/MinaMikhailcom/0825906230cbbe478faf4d08abe9d11a
|
|
||||||
4. Profit!
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
kapow route add /sniff/{iface} -c 'tcpdump -i "$(kapow get /request/matches/iface)" -U -s0 -w - "not port 8080" | kapow set /response/stream'
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
#
|
|
||||||
# Copyright 2019 Banco Bilbao Vizcaya Argentaria, S.A.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
|
|
||||||
kapow route add / - <<-'EOF'
|
|
||||||
kapow set /response/headers/Content-Type text/html
|
|
||||||
kapow set /response/body <<-HTML
|
|
||||||
<html>
|
|
||||||
<body>
|
|
||||||
<a href='javascript: Array.from(document.querySelectorAll("a")).filter(x => x.href.indexOf("magnet") != -1 ).map(x => x.href = "http://localhost:8080/save/magnet?link="+encodeURI(x.href))'>Add me to your bookmarks!</a>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
HTML
|
|
||||||
EOF
|
|
||||||
|
|
||||||
kapow route add /save/magnet -e '/bin/bash -c' - <<-'EOF'
|
|
||||||
link=$(kapow get /request/params/link)
|
|
||||||
[ -z $link ] && kapow set /response/status 400 && exit 0
|
|
||||||
|
|
||||||
watch_folder=/tmp
|
|
||||||
cd $watch_folder
|
|
||||||
[[ "$link" =~ xt=urn:btih:([^&/]+) ]] || exit;
|
|
||||||
echo "d10:magnet-uri${#link}:${link}e" > "meta-${BASH_REMATCH[1]}.torrent"
|
|
||||||
|
|
||||||
kapow set /response/status 302
|
|
||||||
kapow set /response/headers/Location /torrent/list
|
|
||||||
EOF
|
|
||||||
|
|
||||||
kapow route add /torrent/list -c 'kapow set /response/body "Not Implemented Yet"'
|
|
||||||
Reference in New Issue
Block a user