Skip to content

Instantly share code, notes, and snippets.

View AlainODea's full-sized avatar

Alain O'Dea AlainODea

80 followers · 8 following
View GitHub Profile
@AlainODea
AlainODea / Invoke-Unsigned.ps1
Created March 23, 2018 01:42
Run Unsigned PowerShell (human in the loop)
$Script = [System.IO.Path]::GetTempFileName()
(New-Object System.Net.WebClient).DownloadFile("https://path/to/your/script.ps1", $Script)
Get-Content $Script | clip.exe
# right click to run
@AlainODea
AlainODea / Get-IdP-Settings-From-SP.ps1
Last active December 4, 2020 09:14
PowerShell scripts for pulling SAML IdP and SP settings from metadata, with AD FS and Okta examples. Get the last (or only) signing key from WS-Federation FederationMetadata.xml like AD FS publishes for signature certificate rollover (PowerShell)
# Get settings to enter on the Identity Provider (IdP) to allow authentication to Service Provider (SP)
function Get-IdP-Settings-From-SP($Metadata) {
[xml]$SPMetadata = $Metadata
$SPAssertionConsumerServiceURL = $SPMetadata.EntityDescriptor.SPSSODescriptor.AssertionConsumerService |
? {$_.Binding -eq "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"} |
% {$_.Location}
$SPIssuerURI = $SPMetadata.EntityDescriptor.entityID
$SPSignatureCertificate = $SPMetadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor |
? {$_.use -eq "signing"} |
Select-Object -Last 1 |
@AlainODea
AlainODea / har-to-SAMLResponse
Last active January 21, 2018 22:32
SAML Debugging - Pulling SAMLResponse POSTed to Okta from HAR using jq
#!/bin/bash
harFile="${1:=NetworkData.xml}"
cat "${harFile}" |
jq --raw-output --from-file har-to-SAMLResponse.jq | # get URL encoded SAMLResponse
while read; do echo -e ${REPLY//%/\\x}; done | # decode to Base64 SAMLResponse
base64 --decode # decode to XML SAMLResponse
@AlainODea
AlainODea / get-most-recent-log-stream.sh
Created October 30, 2017 19:50
CloudWatch: get most recently updated log stream in a group by stream prefix
#!/bin/bash
logGroupName=$1
logStreamPrefix=$2
aws --profile prod logs describe-log-streams \
--log-group-name ${logGroupName} \
--log-stream-name-prefix ${logStreamPrefix} |
jq --raw-output '.logStreams |=
sort_by(.lastEventTimestamp) |
.logStreams[-1].logStreamName'
@AlainODea
AlainODea / AkamaiRequestHMAC.md
Last active March 1, 2018 13:56
Akamai request signing using HMAC solution

Akamai Request signing using HMAC

Akamai Dynamic Site Delivery supports the use of variables and operations in its configurations that allows for a great deal more flexibility than you might imagine. A great example of this is introducing a form of request signing to make up for the lack of mutual TLS between the CDN and the origin servers.

Customer-configuration variables:

  • HMAC_IV_HEADER: name of the header that will be sent with the HMAC initiatlization vector
@AlainODea
AlainODea / CertificateFingerprinter.java
Created October 28, 2017 23:49
Akamai-compatible certificate fingerprinting (for use with mutual TLS and Extract - Client Certificate - Hashed Fingerprint)
import javax.xml.bind.DatatypeConverter;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
@AlainODea
AlainODea / RELOCATED.md
Last active August 15, 2017 17:13
WIP: zeromq4-haskell ZeroMQ RFC 27/ZAP examples https://github.com/AlainODea-haskell/zeromq-experiments
@AlainODea
AlainODea / README.md
Last active August 5, 2017 19:35
Using ZeroMQ Security (part 2) examples modernized for CZMQ 4.0.2 and ZeroMQ 4.2.2
@AlainODea
AlainODea / GHC_7.10.3_ghci_truss.log
Last active July 23, 2017 00:49
Truss of running GHCi from GHC 7.10.3 build from pkgbuild on SmartOS (problem with segfault)
execve("/usr/bin/bash", 0x08047210, 0x0804721C) argc = 2
sysinfo(SI_MACHINE, "i86pc", 257) = 6
mmap(0x00000000, 32, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANON, -1, 0) = 0xFEFA0000
mmap(0x00000000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0) = 0xFEF90000
mmap(0x00000000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0) = 0xFEF80000
mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANON, -1, 0) = 0xFEF70000
memcntl(0xFEFB5000, 49700, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
memcntl(0x08050000, 148876, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
resolvepath("/usr/lib/ld.so.1", "/lib/ld.so.1", 1023) = 12
resolvepath("/usr/bin/bash", "/usr/bin/bash", 1023) = 13
@AlainODea
AlainODea / Okta_ACS_Issue.md
Last active June 10, 2023 21:39
Okta ACS RelayState issue exploration

An example with minimal dependencies is a loopback within an Okta Org.

Say you want to get to the admin interface of an Org. It's at:

/home/admin-entry

URL encoded (what you need for RelayState) that is: