Skip to content

Instantly share code, notes, and snippets.

View colincowie's full-sized avatar

Colin Cowie colincowie

View GitHub Profile
@colincowie
colincowie / decode.py
Created March 14, 2023 01:55
Decode DocuSign Themed JS Malware Campaign Traffic
import sys
def decode(encoded_str, xor_key):
decoded_str = ""
key_len = len(xor_key)
for i in range(0, len(encoded_str), 2):
encoded_byte = int(encoded_str[i:i+2], 16) # Convert the hexadecimal byte to an integer
xor_key_byte = ord(xor_key[i//2 % key_len]) # Get the corresponding byte from the XOR key
decoded_byte = encoded_byte ^ xor_key_byte # Perform the XOR operation
decoded_str += chr(decoded_byte) # Convert the result back to a character and append to the decoded string
@colincowie
colincowie / webstore.py
Created July 26, 2020 21:08
Get chrome extension urls from the webstore sitemap
import re
from tqdm import tqdm
from requests_html import HTMLSession
class WebStore():
def __init__(self):
self.extensions = []
def get_ext_urls(self):