botlabsDev

import argparse
import json
import time
from pathlib import Path
from typing import Iterable

import requests
from openai import OpenAI

"""

botlabsDev

import uuid
from pprint import pprint

import requests


# https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
# https://www.microsoft.com/en-us/security/blog/2023/04/18/microsoft-shifts-to-a-new-threat-actor-naming-taxonomy/

botlabsDev

from pprint import pprint

import requests

# https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
# https://www.microsoft.com/en-us/security/blog/2023/04/18/microsoft-shifts-to-a-new-threat-actor-naming-taxonomy/

URL = "https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json"

botlabsDev

# Twitter: @botlabsDev
# $ python3 ip_to_asn_history.py 8.8.8.8 --day 2019-01-01
# alternative online tool: https://stat.ripe.net/widget/routing-history


import argparse
import datetime
import ipaddress
import tarfile
from dataclasses import dataclass

botlabsDev

import asyncio
import ssl
import logging
import socket

logging.basicConfig(filename='tls_logs.log', level=logging.INFO)
#socket.setdefaulttimeout(2)

class TlsSinkholeServer(asyncio.Protocol):
    peername = None

botlabsDev

# sudo iptables -t nat -p tcp -I PREROUTING -m multiport --dports 23:65535 -j DNAT --to-destination :5555
# sudo python3 fake_tcp_server.py
# sudo tcpdump -i eth0 port not 22 -C 100000 -w dump

### fake_tcp_server.py

import asyncio


class TcpSinkhole(asyncio.Protocol):

botlabsDev

Keybase proof

I hereby claim:

• I am botlabsdev on github.
• I am botlabsdev (https://keybase.io/botlabsdev) on keybase.
• I have a public key ASBn2VqCK1itTxy5RRpPlR7nAnGjpf98dbSrzhrOw_BRPQo

To claim this, I am signing this object:

botlabsDev

import datetime
import logging
from time import sleep
import requests as requests

logging.basicConfig(level=logging.INFO, filename="git_emails.log")

API_URL = "https://api.github.com/events?per_page=1000"
DENY_LIST = ["example.com", "github.com"]

botlabsDev

#!/bin/bash

mkdir -p $HOME/sharedFolder
/usr/bin/vmhgfs-fuse .host:/ /home/$USER/sharedFolder -o subtype=vmhgfs-fuse

botlabsDev

Vagrant.configure("2") do |config|
  config.vm.box = "peru/ubuntu-20.04-desktop-amd64"
  config.vm.box_version = "20210701.01"

  config.vm.provider "virtualbox" do |vb|
        vb.customize ["modifyvm", :id, "--nictrace1", "on"]
        vb.customize ["modifyvm", :id, "--nictracefile1", "#{File.dirname(__FILE__)}/trace1.pcap"]
  end
end