Skip to content

Instantly share code, notes, and snippets.

View jcaxmacher's full-sized avatar
💭
Focused

J Axmacher jcaxmacher

💭
Focused
View GitHub Profile
@jcaxmacher
jcaxmacher / bash_profile_vs_bashrc.md
Created April 29, 2020 20:00
Bash Profile vs. Bashrc

.bash_profile vs .bashrc

bash(1) can be started in interactive mode or non-interactive mode. It can also act as a login shell or a non-login shell.

bash(1) is started in interactive mode by your terminal emulator and can also be started in interactive mode like this:

bash
@jcaxmacher
jcaxmacher / chapter_break.tex
Created April 29, 2020 19:07
Nice PDFs from Markdown
\usepackage{sectsty}
\sectionfont{\clearpage}
@jcaxmacher
jcaxmacher / incident_response_helpers.py
Created April 11, 2020 20:50
AWS Incident Response Playbook (Jupyter Notebook)
import boto3
import time
from datetime import datetime, timedelta
def execute_log_query(log_group, query, days_to_search):
start_time = int((datetime.today() - timedelta(days=days_to_search)).timestamp())
end_time=int(datetime.now().timestamp())
client = boto3.client('logs')
start_query_response = client.start_query(logGroupName=log_group,startTime=start_time,endTime=end_time,queryString=query,)
query_id = start_query_response['queryId']
@jcaxmacher
jcaxmacher / security_hub_config.py
Created April 7, 2020 22:07
Security Hub Config Custom Resource
import random
import time
import boto3
securityhub = boto3.client('securityhub')
def configure(mas):
if settings.get('MasterAccountId'):
@jcaxmacher
jcaxmacher / gist:3773140d69492b622fced754f1118d87
Created March 2, 2020 03:01 — forked from timmc/pwned-passwords-sqlite-build.py
Building a sqlite DB for the Pwned Passwords data

(There are better ways to do this, such as making a small Python program to load in the data as binary instead of hex—but this is what I did in a pinch and it worked well for what I needed!)

Last executed 2019-06-25 with the v4 dump:

  1. Make sure you have 60 GB free disk space and some extra to spare. Alternatively, take a walk on the wild side and delete source files as soon as you've used them.
  2. Download the SHA-1 (ordered by hash) torrent from https://haveibeenpwned.com/Passwords
  3. Unpack and strip off the counts:
@jcaxmacher
jcaxmacher / dns_event_query.xml
Created February 20, 2020 16:06
event viewer xml query
<QueryList>
<Query Id="0">
<Select Path="Security">
*[EventData[Data[@Name='QueryName'] and (Data='www.google.com')]]
</Select>
</Query>
</QueryList>
@jcaxmacher
jcaxmacher / git-change-commit-messages.md
Created October 23, 2019 13:48 — forked from nepsilon/git-change-commit-messages.md
How to change your commit messages in Git? — First published in fullweb.io issue #55

How to change your commit messages in Git?

At some point you’ll find yourself in a situation where you need edit a commit message. That commit might already be pushed or not, be the most recent or burried below 10 other commits, but fear not, git has your back 🙂.

Not pushed + most recent commit:

git commit --amend

This will open your $EDITOR and let you change the message. Continue with your usual git push origin master.

@jcaxmacher
jcaxmacher / console_url.py
Created August 4, 2019 11:07
Create an AWS Management Console login link with credentials from environment variables
import os, urllib, json, sys
import requests
import boto3
url_credentials = {}
url_credentials['sessionId'] = os.environ['AWS_ACCESS_KEY_ID']
url_credentials['sessionKey'] = os.environ['AWS_SECRET_ACCESS_KEY']
url_credentials['sessionToken'] = os.environ['AWS_SESSION_TOKEN']
json_string_with_temp_credentials = json.dumps(url_credentials)
@jcaxmacher
jcaxmacher / creds.bat
Created August 4, 2019 11:00
Get AWS Assumed-Role Credentials in a Windows-Environment-Variable-friendly format
REM %1 - AWS credential profile for the AssumRole API call
REM %2 - The ARN of the role to assume
REM %3 - The name of the newly created role session
aws --profile %1 sts assume-role --role-arn %2 --role-session-name %3 | python -c "import sys,json;data=sys.stdin.read();creds=json.loads(data);print(f'set AWS_ACCESS_KEY_ID={creds[""Credentials""][""AccessKeyId""]}');print(f'set AWS_SECRET_ACCESS_KEY={creds[""Credentials""][""SecretAccessKey""]}');print(f'set AWS_SESSION_TOKEN={creds[""Credentials""][""SessionToken""]}')"
@jcaxmacher
jcaxmacher / fetch_samples.py
Created August 27, 2018 02:53
Fetch url samples
import json
import urllib.request
import urllib.parse
# Global counter for samples from the same domain
DOMAIN_COUNTS = {}
def get_urls(filename):