jayzeng

Recon and Attack Vectors from My Logs

This document contains excerpts from my web server logs collected over a period of 7 years that shows various kinds of recon and attack vectors.

There were a total of 37.2 million lines of logs out of which 1.1 million unique HTTP requests (Method + URI) were found.

$ sed 's/^.* - - \[.*\] "\(.*\) HTTP\/.*" .*/\1/' access.log > requests.txt

jayzeng

import psycopg2

connection = psycopg2.connect("dbname=name-of-db user=prod password=xxxx host=somehost sslmode=verify-full sslrootcert=/usr/local/share/ca-certificates/ca-2019-root.pem")

jayzeng

-- show running queries (pre 9.2)
SELECT procpid, age(query_start, clock_timestamp()), usename, current_query 
FROM pg_stat_activity 
WHERE current_query != '<IDLE>' AND current_query NOT ILIKE '%pg_stat_activity%' 
ORDER BY query_start desc;

-- show running queries (9.2)
SELECT pid, age(query_start, clock_timestamp()), usename, query 
FROM pg_stat_activity 
WHERE query != '<IDLE>' AND query NOT ILIKE '%pg_stat_activity%' 

jayzeng

HTTP Streaming (or Chunked vs Store & Forward)

The standard way of understanding the HTTP protocol is via the request reply pattern. Each HTTP transaction consists of a finitely bounded HTTP request and a finitely bounded HTTP response.

However it's also possible for both parts of an HTTP 1.1 transaction to stream their possibly infinitely bounded data. The advantages is that the sender can send data that is beyond the sender's memory limit, and the receiver can act on

jayzeng

---
# ^^^ YAML documents must begin with the document separator "---"
#
#### Example docblock, I like to put a descriptive comment at the top of my 
#### playbooks.
#
# Overview: Playbook to bootstrap a new host for configuration management.
# Applies to: production
# Description: 
#   Ensures that a host is configured for management with Ansible.

jayzeng

How to recover lost Python source code if it's still resident in-memory

I screwed up using git ("git checkout --" on the wrong file) and managed to delete the code I had just written... but it was still running in a process in a docker container. Here's how I got it back, using https://pypi.python.org/pypi/pyrasite/ and https://pypi.python.org/pypi/uncompyle6

Attach a shell to the docker container

Install GDB (needed by pyrasite)

apt-get update && apt-get install gdb

jayzeng

/*jshint globalstrict:true */
/*global angular:true */
'use strict';

angular.module('demo', [
    'demo.controllers',
    'demo.directives',
    'elasticjs.service'
]);

jayzeng

This is an example how to perform multi-select faceting in ElasticSearch.

Selecting multiple values from the same facet will result in an OR filter between each of the values:
(facet1.value1 OR facet1.value2)

Faceting on more than one facet will result in an AND filter between each facet:
(facet1.value1 OR facet1.value2) AND (facet2.value1)

I have chosen to update the counts for each facet the selected value DOES NOT belong to since we are performing an AND between each facet.  I have included an example that shows how to keep the counts if you don't want to do this (filter0.sh).

jayzeng

#!/bin/bash
# ========================================
# Testing completion suggest in ElasticSearch
# ========================================

curl -X DELETE localhost:9200/hotels
curl -X PUT localhost:9200/hotels -d '
{
  "mappings": {
    "hotel" : {

jayzeng

Introduction

An introduction to curl using GitHub's API

The Basics

Makes a basic GET request to the specifed URI

curl https://api.github.com/users/caspyin