New article from Shodan presenting: nrich, a command-line tool that "quickly analyze all IPs in a file and see which ones have open ports / vulnerabilities". How to simply install it on Linux:

And to run it, you can simply echo an ip and pipe it to nrich / give it a file containing of list of ips (each one on a different line):

There is also an option to output the result as a .json file:

TomNomNom is showing two techniques to successfully retrieve the flag inside the server. Tweaking the url request to bypass the securities.

First off always analyze the source code: Right click on the page -> 'View Page Source'
'View Page Source' & 'Inspect' are two essential tools. 'Inspect' brings the console were lot of informations on the website are accessible.

The file script.js is interesting here. There is a possible parameter query in the url with the element 'r':

As there is a delay in the script.js before it shows the 'popover' element, the idea is to send a .php payload in the url with a sleep command in it:

The website will hang 30 seconds, so it's working.
Then, back to the script.js, there is an if statement which block us from putting spaces or some special elements in the url:

But '%09' is an url encoded 'tab' and seems to be forgotten if placed after '%3f', an url encoded '?'.
We can add it after the payload and try to send a command that will launch an alert. Note that " will invalidate the url, so instate we use `:

It works! Another cool way to write it (if we can't use any type of quote) is by using 'document.location.hash' and pass our element which won't get inject into the server request but will still be called. 'substring(1)' function removes the #:

The second technique is about DOM clobbering. We can use an anchor tag <a> to inject the XSS payload into his href attribute.

In the script.js file there is a condition check that will remove any string containing the word 'javascript' in the URL.
It's supposed to block us from injecting javascript code but we can actually use it to remove the current window.origin (url) by placing it as a subdomain.
In our payload, we then use 'javaScript' with a capital S as it will bypass the condition check and execute as a normal javascript function.

The '%09' url-encoded tab allow to change the next attribute of our <a>, and give the id of 'origin'.
The <a> become the window.origin and the script.js continue to excecute. The alert works fine and indeed if we type in the console 'window.origin', we get this return value:

Video featuring TomNomNom & Stök going through Tom's tools. Fast & interesting technics inside the terminal & Vim. Lot to keep!

The 'tee' command allow us to both output visually the command process and copy it to a file. Very useful when the execution take some time and we want to make sure something is happening. 'tee -a' to append (as >>)

Useful grep flags. -H: display the filename / -n: display line number / -r: recursive / -i: case insensitive

To output the result directly in Vim:

Then we can, save a file in Vim + give it a name / search for an entry / search and replace all / sort + delete duplicate / delete specific content using grep:

Xargs, another useful command that takes multiple lines as an input and apply the same command to every lines. -n1 for one at a time, {} represent the lines, sh -c to run a shell command:

A really cool tool from TomNomNom is gf, a wrapper around grep that uses regex combinations to help find specific elements.
An exemple below for the aws-keys pattern / for base64:

To efficiently find files: find -type f, and grep to isolate the files that finished by '.js':

TomNomNom shares also a great bash script to efficiently extract objects created for every commits in a Github repo:

Let's say we call it: git_extract.sh, we can then use grep -a (which doesn't block binary files, handy for images) to search for useful misplaced infos: