7h3rAm

"""
A script to automatically export bookmarks from Firefox's SQLite database.

There does not seem to be a programmatic way to get Firefox to export its bookmarks in
the conventional HTML format. However, you can access the bookmark information directly
in Firefox's internal database, which is what this script does.

Always be careful when working with the internal database! If you delete data, you will
likely not be able to recover it.

7h3rAm

Firefox History and Bookmark Command Line Interface

These scripts use fzf and sqlite to efficiently query your firefox history and bookmarks. This is heavily inspired by a post from the creator of fzf: https://junegunn.kr/2015/04/browsing-chrome-history-with-fzf/. fzf allows you to select multiple items and the results returned will be the URLs.

What Does It Look Like?

7h3rAm

ADS-B and LiveATC feeder

Setup for feeding data from my Raspberry Pi to:

• Flightradar24 (ADS-B)
• FlightAware (ADS-B)
• LiveATC (audio)

Hardware:

• Raspberry Pi 4 Debian Bullseye, arm64
• Mode-S Beast MkII (USB ADS-B receiver)

7h3rAm

Tired of spamming Yubikey one-time password (OTP) codes into Slack? Here are two options to help prevent that. You can do either or both. Both require ykman, the Yubikey CLI configuration manager. Get it with Homebrew:

brew install ykman

If you…

• …don't have Homebrew? Install it, then run the command above
• …don't feel comfortable running terminal commands? Skip to the bottom
• …aren't sure what the big deal is? See "What's the big deal with Yubikey codes?" below

7h3rAm

Credit Card Regex

• Amex Card: ^3[47][0-9]{13}$
• BCGlobal: ^(6541|6556)[0-9]{12}$
• Carte Blanche Card: ^389[0-9]{11}$
• Diners Club Card: ^3(?:0[0-5]|[68][0-9])[0-9]{11}$
• Discover Card: ^65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})$
• Insta Payment Card: ^63[7-9][0-9]{13}$
• JCB Card: ^(?:2131|1800|35\d{3})\d{11}$
• KoreanLocalCard: ^9[0-9]{15}$

7h3rAm

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
JAB	🗣 Jabber	$.	Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq	📺 Television	MZ	MZ header
SUVY	🚙 SUV	IEX	PowerShell Invoke Expression
SQBFAF	🐣 Squab favorite	I.E.	PowerShell Invoke Expression (UTF-16)
SQBuAH	🐣 Squab uahhh	I.n.	PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA	💪 "Pah!"	<.	Often used by Emotet (UTF-16)

7h3rAm

#!/usr/bin/env python
# Dependencies:
# - arrow
# - shodan
# - ImageMagick
#
# Installation:
# sudo easy_install arrow shodan
# sudo apt-get install imagemagick
#

7h3rAm

alias radio_news="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/news.pls" # MPR News
alias radio_current="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/the_current.pls" # The Current
alias radio_classical="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/classical.pls" # Classical MPR
alias radio_localcurrent="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/local.pls" # Local Current
alias radio_heartland="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/radio_heartland.pls" # MPR Radio Heartland
alias radio_defcon="mplayer http://sfstream1.somafm.com:6200/"
alias radio_radiopecs="mplayer http://80.237.154.83:8120"
alias radio_wonderground="mplayer http://wondergroundstream2.publicradio.org/wonderground" # MPR Wonderground Windows Media
alias radio_choral="mplayer -playlist http://choralstream1.publicradio.org/choral.m3u" # Clasical MPR Choral
alias radio_wefunk="mplayer -playlist http://www.wefunkr

7h3rAm

Volatility Learning Resources

• Volatility - An advanced memory forensics framework
• Introduction to Volatility
• Volatility | Linux Forensics

Learning Exercises & Examples

• Honeynet | Challenge 7 Forensic Analysis of a Compromised Server
• Google Code | SampleMemoryImages

7h3rAm

Credit card challenge

Exercise: https://gist.github.com/jorin-vogel/2e43ffa981a97bc17259