7h3rAm

Credit Card Regex

• Amex Card: ^3[47][0-9]{13}$
• BCGlobal: ^(6541|6556)[0-9]{12}$
• Carte Blanche Card: ^389[0-9]{11}$
• Diners Club Card: ^3(?:0[0-5]|[68][0-9])[0-9]{11}$
• Discover Card: ^65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})$
• Insta Payment Card: ^63[7-9][0-9]{13}$
• JCB Card: ^(?:2131|1800|35\d{3})\d{11}$
• KoreanLocalCard: ^9[0-9]{15}$

7h3rAm

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
JAB	🗣 Jabber	$.	Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq	📺 Television	MZ	MZ header
SUVY	🚙 SUV	IEX	PowerShell Invoke Expression
SQBFAF	🐣 Squab favorite	I.E.	PowerShell Invoke Expression (UTF-16)
SQBuAH	🐣 Squab uahhh	I.n.	PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA	💪 "Pah!"	<.	Often used by Emotet (UTF-16)

7h3rAm

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAEAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
ZGUuDQ0KJAAAAAAAAABD0tByB7O+IQezviEHs74hE9i6IBKzviET2L0gCbO+IRPYuyC8s74hE9i/
IASzviEHs78hYbO+IWXLQyEPs74hZcu7IC6zviFly7ogFbO+IWXLvSANs74hhsq7IAizviGGyrog
N7O+IYbKvSAAs74hhsq+IAazviGGyrwgBrO+IVJpY2gHs74hAAAAAAAAAABQRQAAZIYGADmYTmIA
AAAAAAAAAPAAIgALAg4fAEYaAABaCAAAAAAASLcXAAAQAAAAAABAAQAAAAAQAAAAAgAABgAAAAAA
AAAGAAAAAAAAAADwIgAABAAAHXAhAAIAYIEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAA
AAAAAAAQAAAAQHUcAIDCAADANx0AKAAAAAAAAAAAAAAAAPAhAGC3AABg+yAAmBUAAADAIgDUIAAA
cOIbABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAw4RsAQAEAAAAAAAAAAAAAAGAaAPACAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAIVFGgAAEAAAAEYaAAAEAAAAAAAAAAAAAAAA

7h3rAm

#!/usr/bin/env python

import sys
import re
import datetime, time
import argparse
import nids

end_states = (nids.NIDS_CLOSE, nids.NIDS_TIMEOUT, nids.NIDS_RESET)

7h3rAm

#!/usr//bin/env python

import sys

if len(sys.argv) != 3:
  print "USAGE: %s <KFFSE_XHKYOKXOHOFEDM^E_Y> <0x2a>" % (sys.argv[0])
  sys.exit(1)

flag = sys.argv[1]
key = int(sys.argv[2], 16)

7h3rAm

import socket

def internet(host="8.8.8.8", port=53, timeout=3):
  """
  Host: 8.8.8.8 (google-public-dns-a.google.com)
  OpenPort: 53/tcp
  Service: domain (DNS/TCP)
  """
  try:
    socket.setdefaulttimeout(timeout)

7h3rAm

from pprint import pprint
from googleapiclient.discovery import build
service = build("customsearch", "v1", developerKey="KEY_HERE")

def search(query):
  res = service.cse().list(q=query, cx="CX_ID_HERE").execute()
  if 1 <= res["queries"]["request"][0]["totalResults"]:
    result = res["items"][0]
    response = result["link"] + "\r\n" + result["snippet"]
  else:

7h3rAm

var out = [];
var pm = PasswordManager.getInstance();
var model = pm.savedPasswordsList_.dataModel;
console.log(model);
var pl = pm.savedPasswordsList_;
for (var i = 0; i < model.length; i++) {
  PasswordManager.requestShowPassword(i);
}
alert('After you press Ok results should appear in ~5 seconds.\n' +
  "If password fields are empty, try increasing the timeout in the last line," +

7h3rAm

# remove password from a pdf file (if password is already known):
qpdf --decrypt --password=<password> infile outfile.pdf

# extract pages from a pdf file:
pdftk infile cat 3-6 output outfile.pdf

# merge pdfs:
pdftk *.pdf cat output outfile.pdf

# convert jpg to pdf:

7h3rAm

#!/usr/bin/env bash

SAMPLESDIR="$1"
TMPFILE="/tmp/sha256sum"
EXT="sample"
MOVE=false

sha256sum "$SAMPLESDIR"/* >"$TMPFILE"
while read line; do
  SHA256=$(echo $line | tr -s " " | cut -d" " -f1)