Skip to content

Instantly share code, notes, and snippets.

View danzek's full-sized avatar
🎵
Listening to meowzek

Dan danzek

🎵
Listening to meowzek
View GitHub Profile
@danzek
danzek / GoogleAnalyticsDomainHashCalculator.cpp
Last active January 2, 2018 21:37
Google Analytics Domain Hash Calculator - Urchin Tracking Module A (utma)
// GoogleAnalyticsDomainHashCalculator.cpp
//
// NOTE: I turned this into a robust CLI tool: https://github.com/danzek/gadhash
//
// Calculates Google Analytics Domain Hash given domain name
// =========================================================
// This corresponds to the first value after "utma=" up until the first dot ('.')
// e.g. in "utma=173272373.nnnnnnn", the domain hash is 173272373 ("google.com")
// do not include the protocol in url (e.g., "http://")
//
@danzek
danzek / md5hash.ps1
Last active January 2, 2018 21:37
MD5 hash files in list provided in text file via PowerShell on Win7
<# Public Domain. Use this however you wish!
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#>
$files = Get-Content "file_path_on_each_line.txt"
Write-Output "File Path,MD5 Hash"
@danzek
danzek / getESindices.go
Last active January 2, 2018 21:35
Print Elasticsearch indices
// Get list of indices from Elasticsearch.
// Yes, I know this boils down to `curl http://localhost:9200/_cat/indices` and shows less information.
// I did this as a personal exercise while learning Go.
/*
Public Domain. Use this however you wish!
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
@danzek
danzek / delete_filebeat_indices.go
Created January 2, 2018 21:35
List Elasticsearch indices and delete those from filebeat
// Get list of indices from Elasticsearch and delete any with filebeat as prefix
// this is ugly and there should be more functions instead of all this crap in main but it's a one-off script
/*
Public Domain. Use this however you wish!
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@danzek
danzek / stealcreds.c
Created October 19, 2017 15:23
LsaRetrievePrivateData User Credential Theft on Windows XP-7
/*
* LsaRetrievePrivateData User Credential Theft on Windows XP-7
* ============================================================
*
* Requires admin privileges to run effectively (use privilege escalation
* exploit first then use this to get password so you are no longer dependent
* on the exploit)
*
* Seen on reddit: https://www.reddit.com/r/Malware/comments/779v21/til_you_can_maintain_administrative_access/
* Code from pastebin dump: https://pastebin.com/u992uP5e
@danzek
danzek / reading_from_stdin_slow.md
Last active April 13, 2017 21:42
Solution for reading lines from stdin being way too slow in C++

StackOverflow Answer


By default, cin is synchronized with stdio, which causes it to avoid any input buffering. If you add this to the top of your main, you should see much better performance:

std::ios_base::sync_with_stdio(false);

Keybase proof

I hereby claim:

  • I am danzek on github.
  • I am digital0day (https://keybase.io/digital0day) on keybase.
  • I have a public key whose fingerprint is ED5F 14F3 C51F 9CC9 0C57 809B 3FC9 7A65 5B4A 6C98

To claim this, I am signing this object: