danzek

Keybase proof

I hereby claim:

• I am danzek on github.
• I am digital0day (https://keybase.io/digital0day) on keybase.
• I have a public key whose fingerprint is ED5F 14F3 C51F 9CC9 0C57 809B 3FC9 7A65 5B4A 6C98

To claim this, I am signing this object:

danzek

StackOverflow Answer

• Retrieved from http://stackoverflow.com/a/9371717/ on April 13, 2017
• Posted by user Vaughn Cato on Feb 21 '12 at 3:24

---

By default, cin is synchronized with stdio, which causes it to avoid any input buffering. If you add this to the top of your main, you should see much better performance:

std::ios_base::sync_with_stdio(false);

danzek

/*
 * LsaRetrievePrivateData User Credential Theft on Windows XP-7
 * ============================================================
 *
 * Requires admin privileges to run effectively (use privilege escalation 
 * exploit first then use this to get password so you are no longer dependent 
 * on the exploit)
 *
 * Seen on reddit: https://www.reddit.com/r/Malware/comments/779v21/til_you_can_maintain_administrative_access/
 * Code from pastebin dump: https://pastebin.com/u992uP5e

danzek

// Get list of indices from Elasticsearch and delete any with filebeat as prefix
// this is ugly and there should be more functions instead of all this crap in main but it's a one-off script

/*
Public Domain. Use this however you wish!

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

danzek

// Get list of indices from Elasticsearch.

// Yes, I know this boils down to `curl http://localhost:9200/_cat/indices` and shows less information.
// I did this as a personal exercise while learning Go.

/*
Public Domain. Use this however you wish!

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR

danzek

<# Public Domain. Use this however you wish!

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
   WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
   COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#>

$files = Get-Content "file_path_on_each_line.txt"
Write-Output "File Path,MD5 Hash"

danzek

// GoogleAnalyticsDomainHashCalculator.cpp
//
// NOTE: I turned this into a robust CLI tool: https://github.com/danzek/gadhash
//
// Calculates Google Analytics Domain Hash given domain name
// =========================================================
// This corresponds to the first value after "utma=" up until the first dot ('.')
// e.g. in "utma=173272373.nnnnnnn", the domain hash is 173272373 ("google.com")
// do not include the protocol in url (e.g., "http://")
//

danzek

#!/usr/bin/env python
# -*- coding: utf-8 -*-

"""
Expert Witness Format (EWF) Extension Helper

Provides generator methods that provide the next expected file extension for EWF and EWF 2 file formats. For instance:

* E01
* E02

danzek

#!/usr/bin/python -tt
# -*- coding: utf-8 -*-
"""
Given the starting line number from the html output (and optional ending line number), parses Internet history
artifacts from a default EnCase 7 HTML report into a nicer looking table. Be sure to customize fields and field widths
as needed.

Copyright 2015, Dan O'Day (d@4n68r.com)

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE

danzek

#!/usr/bin/python
#
# pdtime = parse Droid time - Utility to parse Android Unix timestamps in csv files
#
# Given a csv file or list of csv files containing Android timestamps, create a "parsed" directory and
# output new csv files with timestamps parsed in human-readable format, with no timezone adjustments.
# Android timestamps should be stored in UTC/GMT, and are parsed as such.
#
# Sample timestamp: 1311341729264, Android has three extra numbers than regular UNIX timestamps, because
# it stores UNIX epoch in milliseconds. It must be divided by 1000 to make it a normal UNIX timestamp.