This week I presented my experiences in SQLi filter evasion techniques that I have gained during 3 years of PHPIDS filter evasion at the CONFidence 2.0 conference. You can find the slides here. For a quicker reference you can use the following cheats…

前言 译者注: 翻译本文的最初原因是当我自己看到这篇文章后,觉得它是非常有价值.但是这么著名的一个备忘录却一直没有人把它翻译成中文版.很多人仅仅是简单的把文中的 各种代码复制下来,然后看起来很刁的发在各种论坛上,不过你要真去认真研读这些代码,就会完全不知所云了.原因是这篇文章最精华的部分是代码的解释而非代 码本身. 一方面为了自己学习,一方面也想让更多国内的xss爱好者去更方便的阅读本文.所以虽然我本身英语很烂,xss技术也很烂,但还是去翻译了这篇文 章.当然这也导致最后翻译出来的文章晦涩难懂.…

本文是 XSS防御检查单的翻译版本 https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet 介绍 本文描述了一种恰当地使用输出转码或者转义(encoding or escaping)防御XSS攻击的简单积极模式. 尽管存在巨量XSS攻击方式,遵守一些简单的规则能够彻底防住这类严重的攻击. 本文不探讨XSS攻击的商业和技术影响. reflected and stored XSS 可以…

MySQL SQL Injection Cheat Sheet Some useful syntax reminders for SQL Injection into MySQL databases- This post is part of a series of SQL Injection Cheat Sheets.  In this series, I've endevoured to tabulate the data to make it easier to read and to u…

本文转自:https://www.cheatography.com/ethanium/cheat-sheets/blue-prism-vbo/ Blue Prism MAPIEx Configure Delete Mail Get Contacts Get Mail List Mails Within DateTimes Move Mail Reply To Mail Send Mail Calendars Add Working Days Count Working Days In Range…

Racket Cheat Sheet 来源  http://docs.racket-lang.org/racket-cheat/index.html?q=Racket%20Cheat%20Sheet Essentials Sites main download docs git Community packages users@ dev@ irc slack twitter Running Put #lang racket "Hello, world!" in hello.rkt an…

转自:http://blog.bingo929.com/cheat-sheets-for-web-develop.html Cheat sheet这个词组如果直译成中文,意思大概是”作弊小抄”之类的词,但Cheat sheet这个词的实际意思已经并非是贬义了,虽然中文还没有实际的对应词能够很好的翻译”Cheat sheet”,但大致意思就是用于参考的简洁手册,就像是考试作弊时将必备的数学公式等写在一张纸上,以便考试时查询. 1.CSS Cheat Sheet 2.HTML Cheat Sheet…

Basic and advanced exploits for XSS proofs and attacks. Work in progress, bookmark it. Technique Vector/Payload * * In URLs: & => %26 , # => %23 , + => %2B HTML Context Tag Injection <svg onload=alert(1)>"><svg onload=alert(1…

XSS Cheat Sheet BASICS HTML注入 当输入位于HTML标记的属性值内或标记的外部(下一种情况中描述的标记除外)时使用.如果输入在HTML注释中,则在payload前加上"-->" <svg onload=alert(1)> "><svg onload=alert(1)> HTML注入-标签块突破 ​ 当输入落在以下标签的内部或打开/关闭之间时使用: <title><style><scri…

PostgreSQL Cheat Sheet CREATE DATABASE CREATE DATABASE dbName; CREATE TABLE (with auto numbering integer id) CREATE TABLE tableName ( id serial PRIMARY KEY, name varchar(50) UNIQUE NOT NULL, dateCreated timestamp DEFAULT current_timestamp ); Add a pr…