Skip to content

Instantly share code, notes, and snippets.

Also in

HacKan HacKanCuBa

Also in
Block or report user

Report or block HacKanCuBa

Hide content and notifications from this user.

Learn more about blocking users

Contact Support about this user’s behavior.

Learn more about reporting abuse

Report abuse
View GitHub Profile
HacKanCuBa /
Created Jul 16, 2019
Bruteforce a numeric ID from a SHA256 hash using every CPU core available
#!/usr/bin/env python3
# ***************************************************************************
# Bruteforce a numeric ID from a SHA256 hash.
# Copyright (C) <2019> <Ivan Ariel Barrera Oro>
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
HacKanCuBa /
Last active Jul 17, 2019
Replacing OpenPGP in 2019

Replacing OpenPGP in 2019

It's 2019, and OpenPGP has to die already (for very many reasons I won't list, but see 1, 2 and 3). At least for most uses.
I'll try to list here some replacements categorized by usage (also see 5), because there's no one single-do-all app, and there shouldn't be!

All of this resurfaced because of a vuln exploited recently on SKS keyservers (that has NOTHING to do with OpenPGP nor GnuPG but yes, they're related to the environment) (see 4).

Note: only FOSS software listed (although some server-side implementations could be closed, where applicable).

Listed apps are in no particular order. You should analyze your threat model to know which one to prefer, but as a rule of thumb, go for an easy-to-use one than doesn't let you make a mistake an lose security.

HacKanCuBa /
Created Mar 13, 2019
Django 2 + REST Framework 3 generic settings: it uses env vars with mostly safe defaults (replace PROJNAME for the name of your project; read through the settings and change what you need)
Django settings for PROJNAME project.
Generated by 'django-admin startproject' using Django 2.1.5.
For more information on this file, see
For the full list of settings and their values, see
HacKanCuBa /
Last active Jun 28, 2019
Django Cached: simple cache abstract classes to create and use cached objects.
"""Handle object caching and data retrieval from API endpoints.
These abstract classes makes it easy to use Django's cache with a custom
object, and are very flexible. It support slots natively, and logs cache
- Django 2.0+
- Python 3.6+
"""Wrappers around Python 3 Requests library.
This lib will log errors, warnings and request duration, not raising any
exception: in such error cases, an empty dict is returned. To identify, if
necessary, that there where errors, a with_error flag must be set in the
arguments so that the methods return a tuple in the form of
(response_data: any, error: bool).
If there's any response expected from the endpoint, it will be returned
JSON-converted as-is, which means it's either valid JSON (string, number,
HacKanCuBa / phpinfo.php
Last active Sep 14, 2018
Safe phpinfo file
View phpinfo.php
// Safe PHPInfo file by HacKan
// You should prefer to delete it after using it, but we know how that can go... at least, be safe
// create passwd with:
// php -r '$pass = bin2hex(random_bytes(10)); echo "Plain: ", $pass, PHP_EOL, "Encrypted: ", password_hash($pass, PASSWORD_DEFAULT), PHP_EOL;'
$p = filter_input(INPUT_GET, 'p', FILTER_SANITIZE_STRING);
if (!empty(PASSWD) && !empty($p) && password_verify($p, PASSWD)) {
HacKanCuBa / exfiltrate.html
Created May 15, 2018
PoC to exfiltrate signal-desktop messages exploiting CVE-2018-11101 or CVE-2018-10994
View exfiltrate.html
<!DOCTYPE html>
<meta charset="utf-8"/>
DO NOT USE THIS IN REAL LIFE, IT'S JUST A POC! Be nice, don't hack activists :)
by HacKan:
under GNU GPL v3.0+
HacKanCuBa /
Last active Jun 25, 2019
Properly signing Github releases

Github automatically generates .tar.gz and .zip packages of the repository when a release or pre-release is created under releases. However, these packages are not signed! The tag might be signed but if a user downloads one of those, there's no true certification of its content, rather than pure trust on Github.

However, you can edit a release after it's generated to upload files, and this is how you upload signature files for those packages (as I usually do). But, to sign them, you need to first download them and, of course, verify them! Otherwise, you'll be signing your trust to Github without checking!

I will be using a tool I created to do recursive blake2 checksums called b2rsum. You can use any other tool that does the same if you want.

To properly verify those packages, do the following:

  1. Create a temporal directory to store all files, lets call it /tmp/github.
  2. Copy your source code to a subdirectory there: cp -r ~/code/myproject /tmp/github/orig.
HacKanCuBa / sshd_config
Last active Jun 21, 2019
Modern secure SSH daemon config
View sshd_config
# Modern secure (OpenSSH Server 7+) SSHd config by HacKan
# Refer to the manual for more info:
# Server fingerprint
# Regenerate with: ssh-keygen -o -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa -b 4096
HostKey /etc/ssh/ssh_host_rsa_key
# Regerate with: ssh-keygen -o -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
HostKey /etc/ssh/ssh_host_ed25519_key
# Log for audit, even users' key fingerprint
HacKanCuBa /
Last active Jul 15, 2019
Encrypted SWAP hibernation in Debian 9+

Encrypted SWAP hibernation in Debian 9+

It took me about 6 hours to find out all of this, but after reading a ton of man pages, initram scripts, and bug reports, I got a working result that takes about 2' to set up...

The point is to have a SWAP partition encrypted with LUKS, and it should be decypted during boot.

When using SysV, initram hooks and scripts in Debian worked like a charm but then, Systemd came and it's not yet fully implemented so this kind of crap happens. Systemd's cryptsetup doesn't support parameters in /etc/crypttab so using a script there is ignored:

/* Options Debian's crypttab knows we don't:
You can’t perform that action at this time.