Manouchehri

https://rfc3161.ai.moda
https://rfc3161.ai.moda/adobe
https://rfc3161.ai.moda/microsoft
https://rfc3161.ai.moda/apple
https://rfc3161.ai.moda/any
http://rfc3161.ai.moda
http://timestamp.digicert.com
http://timestamp.globalsign.com/tsa/r6advanced1
http://rfc3161timestamp.globalsign.com/advanced
http://timestamp.sectigo.com

Manouchehri

# Source:
# https://www.cloudflare.com/ips
# https://support.cloudflare.com/hc/en-us/articles/200169166-How-do-I-whitelist-CloudFlare-s-IP-addresses-in-iptables-

for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done
for i in `curl https://www.cloudflare.com/ips-v6`; do ip6tables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done

# Avoid racking up billing/attacks
# WARNING: If you get attacked and CloudFlare drops you, your site(s) will be unreachable. 
iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP

Manouchehri

IDrive e2     - $0.005/GB  - $0 for download bandwidth - 1:3 upload:download ratio allowed <- questionable data privacy - custom domains offered - has audit logging - supports event notifications with AWS SQS - $0.01/GB overage on bandwidth - has replication
Backblaze B2  - $0.006/GB  - $0 for download bandwidth if through Worker (or $0.01/GB past a 1:3 upload:download ratio) <- decent data privacy record - no custom domains - has audit logging - has replication
Vultr         - $0.018/GB  - $0.01/GB for download <- https://www.vultr.com/products/object-storage/#pricing
Wasabi        - $0.0069/GB - $0 for download bandwidth - 1:1 and billed for 90 days <- has audit logging - no custom domains - min object size billed at 4 kilobytes
Storj         - $0.004/GB  - $0.007/GB for download <- not good for small files due to segment pricing
Scaleway      - $0.013/GB  - $0.011/GB for download <- estimate, had to do EUR to USD conversion https://www.scaleway.com/en/pricing/storage/
Cloudflare R2 - $0.015/GB  - $0.00/GB 

Manouchehri

Last Updated: 7 May 2025
------------------------
In this package, you will find a brief introduction to the Scripting API for DaVinci Resolve Studio. Apart from this README.txt file, this package contains folders containing the basic import
modules for scripting access (DaVinciResolve.py) and some representative examples.

From v16.2.0 onwards, the nodeIndex parameters accepted by SetLUT() and SetCDL() are 1-based instead of 0-based, i.e. 1 <= nodeIndex <= total number of nodes.

Overview
--------
As with Blackmagic Fusion scripts, user scripts written in Lua and Python programming languages are supported. By default, scripts can be invoked from the Console window in the Fusion page,

Manouchehri

Recovering the BIOS password from a Panasonic CF-U1 mk2 (AMI Aptio UEFI)

A mess of my own making

While messing with a CF-U1 handheld PC that I bought off ebay I managed to mess up the BIOS and it seems it reverted to previous settings which included an unknown BIOS password, it would however still boot into windows. Since I could still boot windows I was able to dump the bios flash using AFUWINGUI.EXE the version I used was 3.09.03.1462 which is available here:
https://ami.com/en/?Aptio_4_AMI_Firmware_Update_Utility.zip

Manouchehri

shuf -i 49152-60999 -n1

# This obeys:
# RFC 6335  49152-65535 - https://www.rfc-editor.org/rfc/rfc6335.html
# Linux     32768-60999 - https://github.com/torvalds/linux/blob/1f5abbd77e2c1787e74b7c2caffac97def78ba52/net/ipv4/af_inet.c#L1833-L1834
# Windows   49152-65535 - https://learn.microsoft.com/en-US/troubleshoot/windows-server/networking/default-dynamic-port-range-tcpip-chang

# Why does this matter? Naively, this gives us the best chance of not having our port changed when going through NAT.
# In reality, it probably doesn't help.

Manouchehri

__author__ = 'David Manouchehri'

from bs4 import BeautifulSoup
import urllib.request
import gzip
import io

url = 'http://yoururlgoesherehopefullythisisntavalidurl.com/pages.html'

headers = {'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

Manouchehri

Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the > Wireless > Access Control > Add Managed Device screen.

Impact: 
Script can be stored in Database and execute every time when users visits it. If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
Amongst other things, the attacker can:
1) Perform any action within the application that the user can perform. 
2) View any information that the user is able to view. 
3) Modify any information that the user is able to modify. 
4) Initiate interactions with other application users, including malicious attacks, that will appear to originate from  the initial victim user.

Manouchehri

#!/usr/bin/env python2
# -*- coding: utf-8 -*-

# Author: David Manouchehri <manouchehri@protonmail.com>
# This script will always echo back data on the UDP port of your choice.
# Useful if you want nmap to report a UDP port as "open" instead of "open|filtered" on a standard scan.
# Works with both Python 2 & 3.

import socket

Manouchehri

if (ObjC.available) {
    try {
        // list methods
        // ObjC.classes.XXXClassName.$ownMethods.forEach(function (m) {
        //     console.log('method: ' + m);
        // })

        // watch method callstack
        // if (1) {
        //     // -[NSTimeZone secondFromGMT]