Skip to content

Instantly share code, notes, and snippets.

View ericlaw1979's full-sized avatar
💭
Working on Microsoft Web Defense

Eric Lawrence ericlaw1979

💭
Working on Microsoft Web Defense
158 followers · 4 following
View GitHub Profile
@ericlaw1979
ericlaw1979 / Get-ProcessHash.ps1
Last active October 12, 2021 22:40 — forked from pronichkin/Get-ProcessHash.ps1
Get a truncated SHA-1 hash for each running process name; use this to decipher edge://histograms/UIA process info
# Mostly written by https://gist.github.com/pronichkin/b1fcd7b797ed7194dce0a96d98765aa7
Get-Process | Sort-Object -Unique -Property 'Name' | Select-Object -Property @(
@{
'Label' = 'Name'
'Expression' = {
$psItem.Name + ".exe"
}
}
@ericlaw1979
ericlaw1979 / zipread.cs
Last active June 3, 2021 14:29
ZIP integrity checker
// https://stackoverflow.com/a/51860115/126229
// https://games.greggman.com/game/zip-rant/ -- Great article explaining why this format is kinda bad.
using System;
using System.IO;
using System.Text;
namespace ZipAnalysis
{
class Utilities {
public static string ByteArrayToHexView(byte[] inArr, int iStartAt, int iBytesPerLine, int iMaxByteCount, bool bShowASCII)
@ericlaw1979
ericlaw1979 / TypeTheClipboard.vbs
Created February 18, 2021 16:46
Types the contents of the clipboard to the focused text area three seconds after invocation (useful for using sites/apps that block CTRL+V paste). Useful as a script launched from [SlickRun](https://bayden.com/slickrun)
set WshShell = WScript.CreateObject("WScript.Shell")
WScript.Sleep 3000
'Hackery to get the clipboard's contents
Set objHTML = CreateObject("htmlfile")
text = objHTML.ParentWindow.ClipboardData.GetData("text")
WshShell.SendKeys text
@ericlaw1979
ericlaw1979 / ShowOriginalSessionID.js
Created December 1, 2020 19:00
Show the pre-save sessionID in a column for loaded Fiddler SAZ files
public BindUIColumn("OrigID", 50 /*width*/, 1 /*order*/, true/*sortNumerically*/)
static function ShowOriginalID(oS: Session): String {
return oS["x-OriginalSessionID"];
}
@ericlaw1979
ericlaw1979 / gist:0daa972269eb4c2efacf068c06173a10
Created December 1, 2020 18:51
Show Low-level read timings
// https://groups.google.com/d/msg/httpfiddler/BNnW_Y9jxCQ/eIaQsKhInPoJ
// https://microsite.omniture.com/t2/help/en_US/sc/implement/index.html#Sample_Product_Strings
public BindUITab("ReadTiming", true)
static function readsReport(arrSess: Session[]):String {
var oSB: System.Text.StringBuilder = new System.Text.StringBuilder();
oSB.Append("<html><head></head><body>");
for (var i:int = 0; i<arrSess.Length; i++)
{
var sClt:String = arrSess[i].Timers.ClientReads.ToString();
var sSrv:String = arrSess[i].Timers.ServerReads.ToString();
@ericlaw1979
ericlaw1979 / META CACHING Directives.ms
Created March 2, 2020 20:07
MeddlerScript test case. Only IE and Edge 18 and below support META cache-control and META pragma https://crbug.com/2763 https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives
/*
Only IE and Edge 18 and below support META cache-control and META pragma
https://crbug.com/2763
https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives
*/
import Meddler;
import System;
import System.Net.Sockets;
import System.Windows.Forms;
@ericlaw1979
ericlaw1979 / META CACHING Directives.ms
Created March 2, 2020 20:07
Only IE and Edge 18 and below support META cache-control and META pragma https://crbug.com/2763 https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives
/*
Only IE and Edge 18 and below support META cache-control and META pragma
https://crbug.com/2763
https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives
*/
import Meddler;
import System;
import System.Net.Sockets;
import System.Windows.Forms;
@ericlaw1979
ericlaw1979 / META CACHING Directives.ms
Created March 2, 2020 20:07
Only IE and Edge 18 and below support META cache-control and META pragma https://crbug.com/2763 https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives
/*
Only IE and Edge 18 and below support META cache-control and META pragma
https://crbug.com/2763
https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives
*/
import Meddler;
import System;
import System.Net.Sockets;
import System.Windows.Forms;
@ericlaw1979
ericlaw1979 / ServerSentEvents.ms
Last active December 4, 2019 16:15
MeddlerScript for testing ServerSentEvents. See https://textslashplain.com/2019/12/04/the-pitfalls-of-eventsource-over-http-1-1/ for discussion.
import Meddler;
import System;
import System.Net.Sockets;
import System.Windows.Forms;
class Handlers
{
static function OnConnection(oSession: Session)
{
try {
@ericlaw1979
ericlaw1979 / RegisterForDirectInvoke.reg
Created September 25, 2019 21:15
This registry script registers a new file type `.fuzzle` with the MIME-type `application/x-fuzzle` and instructs IE and Edge that the file should be opened using the DirectInvoke mechanism.
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.fuzzle]
"Content Type"="application/x-fuzzle"
@="FuzzleProgID"
[HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-fuzzle]
"Extension"=".fuzzle"
[HKEY_CLASSES_ROOT\FuzzleProgID]