Skip to content

Instantly share code, notes, and snippets.

View kaganisildak's full-sized avatar
🐼
wofap

Kağan IŞILDAK kaganisildak

🐼
wofap
View GitHub Profile
@swisskyrepo
swisskyrepo / main.yml
Created March 12, 2022 23:03
Elastic EDR Ansible
---
- name: Add required dependencies.
apt:
name:
- apt-transport-https
- gnupg2
state: present
- name: Add Elasticsearch apt key.
apt_key:
@ander94lakx
ander94lakx / yara_linux_install.sh
Last active May 3, 2023 00:39
YARA install script for linux systems (with crypto support
# Download YARA (Modify if a different version is needed)
wget https://github.com/VirusTotal/yara/archive/refs/tags/v4.1.2.tar.gz
tar -zxf yara-4.1.2.tar.gz
cd yara-4.1.2
./bootstrap.sh
# Prerequisites
sudo apt install automake libtool make gcc pkg-config libssl-dev
# Build with make
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Thomas Roccia | IconDhash.py
# pip3 install lief
# pip3 install pillow
# resource: https://www.hackerfactor.com/blog/?/archives/529-Kind-of-Like-That.html
import lief
import os
import argparse
@Neo23x0
Neo23x0 / Base64_CheatSheet.md
Last active March 10, 2024 09:15
Learning Aid - Top Base64 Encodings Table

Base64 Patterns - Learning Aid

Base64 Code Mnemonic Aid Decoded* Description
JAB 🗣 Jabber $. Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq 📺 Television MZ MZ header
SUVY 🚙 SUV IEX PowerShell Invoke Expression
SQBFAF 🐣 Squab favorite I.E. PowerShell Invoke Expression (UTF-16)
SQBuAH 🐣 Squab uahhh I.n. PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA 💪 "Pah!" <. Often used by Emotet (UTF-16)
@smgorelik
smgorelik / Hollowing.cs
Last active September 5, 2023 14:12
Simple Process Hollowing C#
/***************
* Simple Process Hollowing in C#
*
* #Build Your Binaries
* c:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe Hollowing.cs /unsafe
*
* @author: Michael Gorelik <smgorelik@gmail.com>
* gist.github.com/smgorelik/9a80565d44178771abf1e4da4e2a0e75
* #Most of the code taken from here: @github: github.com/ambray
@0xjac
0xjac / private_fork.md
Last active May 5, 2024 05:54
Create a private fork of a public repository

The repository for the assignment is public and Github does not allow the creation of private forks for public repositories.

The correct way of creating a private frok by duplicating the repo is documented here.

For this assignment the commands are:

  1. Create a bare clone of the repository. (This is temporary and will be removed so just do it wherever.)

git clone --bare git@github.com:usi-systems/easytrace.git

@ilammy
ilammy / Makefile
Created April 5, 2015 18:31
Linux kernel system call table hooking
obj-m += afw.o
afw-objs := afw_main.o locate_sct.o ttgl.o
ccflags-y := -std=gnu99 -O2
all:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean