New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Password generating script
Looking for ready2go script to generate passwords. Something like:
- https://passwordsgenerator.net/
- https://1password.com/password-generator/
- https://www.dashlane.com/features/password-generator
- https://www.random.org/passwords/
Best if it is in PHP.
Comments
Ask chatgpt, and that way you can learn at the same time
With or without RCE?
There's a few on Codecanyon, mostly only using JS;
https://codecanyon.net/item/pass-gen-strong-password-generator/50965159
https://codecanyon.net/item/password-generator/40732156
And some on GH like this: https://github.com/devloop01/password-generator
send pm
RCE must be included as obligatory way to troll. Thanks!
LET is the best password generator: x§oIUj09u$§34t&v437%4__#t25",32+3k%opF(sfeW
Need more?
Can't post code since Cloudflares WAF gets mad, but here you go, with RCE.
(this is my password generator on my terminal
)
intval($_GET['length'])if you want to be boring.Not a php pro so never heard of intval. + he wanted RCE.
Yeah i got confused a little too (length isn't exactly much of a predictable measure if the whole thing is base64 encoded anyways it seems) but intval is basically forcing the length variable to be a number. If that doesn't make sense for the value passed (because it's some random string or whatever) the result will probably be zero but at least it'll strip any kind of weird characters messing with the shell. Poor mans input sanitizing so to say
Nice, unescaped GET directly executed on terminal. Nothing can go wrong here…
Over the years, I've used these to generate passwords:
He's right though. You wanted RCE. If you prefer to be boring just see my earlier post.
Yup, RCE is funny like that.
Funny coincidence since you are speaking of RCE, but right last week I found a nice one in a PHP app (of course) that renders files whose path is specified in a param, and has a local file inclusion vulnerability, i.e. it doesn't restrict which files I can render that way so I was able to see some stuff that I shouldn't, but I waited before reporting it as it was similar to another case I worked on a few months ago.
So I used the LFI vulnerability to render the Apache logs, which worked, and then sent a request to the server that includes a code snippet in the user agent, with the code snippet executing the command passed in the
cmdparam.Since the content of the file you render is parsed with PHP, and since the user agent is logged with the request, I got a nice RCE there, and I was able to also run a shell with this trick.
Found this after 4 hours exploring the app. Reward: $6K
If you want something in the terminal, you can just run
openssl rand -hex 100oropenssl rand -base64 100, if you have openssl installed, which I think it's installed by default in all modern OSes.I love this initial access path, apache logs because php code in your user agent
Hmm, And if everyone asks the gpt chat to write them such a code, does this mean that everyone's code will be the same?
why davide banned?
Harassment towards a member, a certain LET moderator had enough and banned him. He's moved over to OGF only to be attacked again (may be very well deserved) and still is currently active.