Skip to content

Instantly share code, notes, and snippets.

View int13h's full-sized avatar

Paul Halliday int13h

49 followers · 5 following
View GitHub Profile
@int13h
int13h / Format flubbed intel feeds
Created October 28, 2014 19:32
sed -E 's/[[:space:]]{2,}/ /g'
@int13h
int13h / Intel parser
Created November 5, 2014 18:20
#!/usr/local/bin/bash
lists="\
DOMAIN,MalwareDomains,http://mirror1.malwaredomains.com/files/justdomains \
DOMAIN,ZeusTracker,https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist \
DOMAIN,SpyEye,https://spyeyetracker.abuse.ch/blocklist.php?download=domainblocklist
"
workdir="$PWD"
output="intel_domains.dat"
temp="tmp.txt"
@int13h
int13h / Http log
Created November 6, 2014 18:11
#!/usr/local/bin/bash
n=$#
if [ $n -gt 1 ]; then
date=$1
format=$2
case "$format" in
1) zcat $date/http.* | gawk '{print strftime("%Y-%m-%d %T", $1),$3,$9$10}'
;;
@int13h
int13h / Awk time constraint
Created November 18, 2014 13:26
gawk '{print strftime("%Y-%m-%d %T", $6),$8,$10,$13,$14$15}' | awk '"09:43:08" < $2 && $2 <= "11:03:57"'
@int13h
int13h / keybase.md
Created September 19, 2017 15:14

Keybase proof

I hereby claim:

  • I am int13h on github.
  • I am paulh (https://keybase.io/paulh) on keybase.
  • I have a public key whose fingerprint is 5921 9BD3 87F0 BD56 3B35 EC6D 93C6 1894 C5A6 3828

To claim this, I am signing this object: