dfir-scripts

# find and hash one or more files 
# Change include and path values as needed
gci -r -path C:\Windows\ -include explorer.exe, notepad.exe -erroraction silentlycontinue|Get-FileHash  -algorithm md5|sort-object |ft hash, path -AutoSize

dfir-scripts

#reverse Endian

echo $1|grep -o .. |tac| tr -d '\n'

# example: echo  "01d622d7c5a55c70|grep -o .. |tac| tr -d '\n'

dfir-scripts

#! /usr/bin/python3
import
re
sys
ipaddress
f = open(sys.argv[1],'r')
string = f.read()
ip_list = []
ip_private = []
regex = re.findall(r'\b25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\.25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\.25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\.25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\b',string)

dfir-scripts

import requests
import csv

API_KEY = ''  # Replace with your VirusTotal API key

def get_domain_report(domain):
    url = f'https://www.virustotal.com/vtapi/v2/domain/report'
    params = {'apikey': API_KEY, 'domain': domain}
    response = requests.get(url, params=params)
    return response.json()

dfir-scripts

#!/usr/bin/python
import hashlib
import binascii

try:
    print("Enter Password")
    password = input()
    hash = hashlib.new('md4', password.encode('utf-16le')).digest()
    print(binascii.hexlify(hash).decode("utf-8"))
except:

dfir-scripts

vi -c ":set nobomb" -c ":%s/\r//g" -c ":wq" input_file.txt

dfir-scripts

import json

def convert_to_dict(lines):
    """
    Convert lines of text into a dictionary.

    Args:
        lines (list): A list of strings, each containing a key-value pair separated by "|".

    Returns:

dfir-scripts

#! /bin/bash
[ $(whoami) != "root" ] && echo "Requires sudo!" && exit

# Install powershell and dotnet 9
which pwsh || snap install powershell --classic
which dotnet && dotnet --list-runtimes|grep 9\\.0 || \
add-apt-repository ppa:dotnet/backports -y  && \
apt-get update
apt-get install -y dotnet-sdk-9.0 -y  || exit

dfir-scripts

#!/usr/bin/env python3
"""
Simple NT Hash Generator
Uses impacket to generate NT hash from password input
"""

from impacket.ntlm import compute_nthash

def main():
    print("NT Hash Generator")