Skip to content

Instantly share code, notes, and snippets.

View blackfist's full-sized avatar

Kevin Thompson blackfist

View GitHub Profile
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
@blackfist
blackfist / git.md
Last active August 29, 2015 13:56
Git stuff I don't want to forget

fetch a remote branch

git checkout --track origin/daves_branch

Undo a commit from a few commits ago that was pushed up to github. Be warned that if you do this everyone will have to basically blow away their local copy of the repo and do a fresh git pull.

git rebase -i HEAD~4 
git push --force

That will show all the commits going back 4 and let you pick which ones you want to keep. A better way might be to delete the files, then you wont be rewriting history

@blackfist
blackfist / schema_update.py
Created February 12, 2014 21:01
Add a region code to veris - experimental
# Download https://raw2.github.com/lukes/ISO-3166-Countries-with-Regional-Codes/master/all/all.json
# and save as all.json in the same folder
import json
import os
from datetime import datetime
import uuid
# i = getIncident('blahblahblah.json')
def getIncident(inString):
return json.loads(open(inString).read())
{
"type": "text",
"from": {"data": "site"},
"properties": {
"enter": {
"text":"This is some text.",
"align": "center",
"baseline": "bottom",
"fill": {"value": "#000"}
}
#!/usr/bin/env python
import json
vDict=json.loads(open('verisc-enum.json').read())
def dict_walker(inCollection, pre=None):
pre = pre[:] if pre else []
#print(pre)
if isinstance(inCollection, dict):
@blackfist
blackfist / simple_bar.R
Last active August 29, 2015 13:56
Simple bar chart of vcdb data using Jay's veris package
library(verisr)
library(ggplot2)
# Load the data
vcdb.dir <- "../vcdb/data/json"
vcdb <- json2veris(vcdb.dir)
# Filter out the Unknowns
filt <- !getfilter(vcdb, list("action.hacking.variety"="Unknown"))
def aggregateIndustry(inArray):
returnArray = [{'_id':'31-33','friendly_name':'Manufacturing','count':0},
{'_id':'44-45','friendly_name':'Retail','count':0},
{'_id':'48-49','friendly_name':'Transportation','count':0}]
for eachIndustry in inArray:
if eachIndustry['_id'] in ['31','32','33']:
returnArray[0]['count'] += eachIndustry['count']
continue
if eachIndustry['_id'] in ['44','45']:
returnArray[1]['count'] += eachIndustry['count']
@blackfist
blackfist / sample strings.txt
Last active January 2, 2016 01:39
just fucking around
http://www.utphysicians.com/21756/uthealth-informs-patients-incident-related-patient-information/ (20130830),http://healthitsecurity.com/2013/08/29/ut-physicians-informs-patients-of-data-breach/ (20130830)
https://oag.ca.gov/system/files/Final%20version%20of%20breach%20notification%20in%20PDF%20format%20%2800751822%29_0.PDF http://www.phiprivacy.net/burglar-snatches-laptop-with-patient-medical-records-from-san-jose-internists-office/
http://doj.nh.gov/consumer/security-breaches/documents/waste-management-20070403.pdf
@blackfist
blackfist / malware.md
Last active June 4, 2018 14:02
Recommended reading for malware analysis
  1. http://computer-forensics.sans.org/blog/2010/11/12/get-started-with-malware-analysis
  2. http://zeltser.com/malware-analysis-toolkit/
  3. http://zeltser.com/vmware-malware-analysis/
  4. http://computer-forensics.sans.org/blog/2010/10/11/3-phases-malware-analysis-behavioral-code-memory-forensics/
  5. BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection https://www.usenix.org/legacy/event/sec08/tech/full_papers/gu/gu.pdf
  6. Mining the Network Behavior of Bots http://isg.rhul.ac.uk/sullivan/pubs/tr/2009-12.pdf
  7. Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces https://www.usenix.org/legacy/event/nsdi10/tech/full_papers/perdisci.pdf
  8. From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final127.pdf
  9. Obfuscation of executable code to improve resistance to static disassembly http://www.cs.arizona.edu/~debray/Pub