Skip to content

Instantly share code, notes, and snippets.

View kazkansouh's full-sized avatar

Karim Kanso kazkansouh

21 followers · 0 following
  • UK
View GitHub Profile
@kazkansouh
kazkansouh / searchsploit-filt.sh
Created August 28, 2020 10:29
Wrapper script for searchsploit that uses jq to sort the results by date.
#! /bin/bash
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
@kazkansouh
kazkansouh / mysql-udf-build.sh
Created August 24, 2020 09:23
Simplify building MySQL UDF exploit for both Linux and Windows
#!/bin/bash
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
@kazkansouh
kazkansouh / rshell-build.sh
Last active December 26, 2020 08:59
Bash script for building a windows reverse shell.
#!/bin/bash
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
@kazkansouh
kazkansouh / crc32-extender.c
Created April 29, 2020 14:07
Simple algorithm to modify a payload in such a way to have a specific CRC32 value
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
const uint32_t ui_crc32_table[] =
{
0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419, 0x706af48f,
0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91, 0x1db71064, 0x6ab020f2,
@kazkansouh
kazkansouh / prime-test.c
Created December 13, 2019 17:57
Command line app to call openssl primality check
/* Copyright (C) 2019 Karim Kanso. All Rights Reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
@kazkansouh
kazkansouh / bleichenbacher.py
Created December 9, 2019 08:23
Classic Bleichenbacher RSA Padding Oracle Attack
#! /usr/bin/env python3
# Copyright (C) 2019 Karim Kanso. All Rights Reserved.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
@kazkansouh
kazkansouh / url_decode.c
Created February 23, 2019 08:56
URL decode in C with only stdlib as dependency, written for use on an embedded device.
#include <stdio.h>
#include <stdlib.h>
void urldecode(char* pch_url) {
int i = 0;
char* ptr = pch_url;
while (*ptr != '\0') {
if (*ptr != '%') {
pch_url[i++] = *(ptr++);
@kazkansouh
kazkansouh / sendRawEth.c
Last active May 1, 2021 15:57 — forked from austinmarton/sendRawEth.c
Send a raw Ethernet frame in Linux
/*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Based off code from:
* https://gist.github.com/austinmarton/1922600
*
* Modified to send hand crafted IPv6 NDP Neighbor
@kazkansouh
kazkansouh / aiohttp-issue.py
Last active November 27, 2018 15:38
Investigate an issue with aiohttp when using StreamReader as the body of a post resulting in poor performance.
#! /usr/bin/python3
#
# Demonstrates an issue identified on aiohttp version 3.2.1, 3.3.0,
# where the upload between frontend and backend stalls (or goes very
# slowly by only sending chunks of 128 bytes due to tcp window being
# full). This only happens when both the sender and receiver are in
# the same event loop and lots of small chunks are sent triggering the
# performance hit. To mitigate this performance hit, the size of the
# chunks should be maximised. The issue is exasperated in versions of
# aiohttp <= 3.3.0 as the default iterator used tries to read the
@kazkansouh
kazkansouh / Dockerfile
Last active October 5, 2018 15:24
GNS3 ipterm image with support for dhclient instead of udhcpc
FROM gns3/ipterm:latest
RUN DEBIAN_FRONTEND=noninteractive && \
apt-get -q update && \
apt-get -qq -y install isc-dhcp-client && \
rm -rf /var/lib/apt/lists/*
# Need to make dhclient available during init script execution
# RUN mkdir -p /tmp/gns3/bin && ln -s /sbin/dhclient /tmp/gns3/bin/dhclient
# ^^ does not work as directory /tmp/gns/bin should not exist.