Skip to content

Instantly share code, notes, and snippets.

View kyhwana's full-sized avatar

Kyhwana Pardus kyhwana

48 followers · 22 following
View GitHub Profile
@kyhwana
kyhwana / gist:bd80e180ca7c9245e32aa45cfe5620d6
Created January 23, 2018 23:52
Authy 2.5.0_0 diff to show TOTP account secrets.
19316,19317d19315
< }, d.prototype.getSharedSecret = function() {
< return this.isEncrypted() ? "?" : this.decryptedSeed
26333,26337d26330
< }), f(".copysecret").click(function (t) {
< var n, r, o;
< return n = f(this), o = function () {
< return n.text("Copy Secret")
< }, r = n.parent().find(".sharedSecret")[0], e.onCopyClicked(r), n.text("Copied secret"), setTimeout(o, 1e3)
26378,26380c26371
@kyhwana
kyhwana / sslhdebianapparmorprofile
Created January 16, 2018 03:27
sslh apparmor profile for debian 9
# Last Modified: Tue Jan 16 16:27:04 2018
#include <tunables/global>
/usr/sbin/sslh {
#include <abstractions/base>
#include <abstractions/dovecot-common>
#include <abstractions/nameservice>
#include <abstractions/nis>
#include <abstractions/postfix-common>
@kyhwana
kyhwana / enable-asr-win10fcu.ps1
Last active May 1, 2018 23:52
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550,D4F940AB-401B-4EFC-AADC-AD5F3C50688A,3B576869-A4EC-4529-8536-B80A7769E899,75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84,D3E037E1-3EB8-44C8-A917-57927947596D,5BEB7EFE-FD9A-4556-801D-275E5FFC04CC,92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B -AttackSurfaceReductionRules_Actions Enabled, Enabled, Enabled, Enabled, Enabled, Enabled, Enabled
#1803 new rules:
#Set-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25,c1db55ab-c21a-4637-bb3f-a12568109d35,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,d1e49aac-8f56-4280-b9ba-993a6d77406c,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 -AttackSurfaceReductionRules_Actions Enabled, Enabled, Enabled, Enabled, Enabled
#Anti-PUA rule:
Set-MpPreference -PUAProtection Enabled
@kyhwana
kyhwana / gist:0002cc64e8938e142e82b807e55e0b60
Created October 22, 2017 04:12
Password manager audits.
Lastpass: All under NDAs. https://lastpass.com/support.php?cmd=showfaq&id=1626
1password: https://support.1password.com/security-assessments/
keepass: https://www.ghacks.net/2016/11/22/keepass-audit-no-critical-security-vulnerabilities-found/
enpass: none.
pass: none?
@kyhwana
kyhwana / inotify-dl.sh
Created August 19, 2017 03:36
inotifywait -m /opt/dionaea/var/dionaea/binaries/ -e create |
while read path action file; do
if [[ "$file" != *"smb"* ]]; then
if [[ "$file" != *"httpupload"* ]]; then
date=`date`
echo "The file '$file' appeared in directory '$path' via '$action' at '$date'"
firejail --quiet yara -w /opt/dionaea/rules-master/malware_index.yar $path$file
firejail --quiet clamscan $path$file --no-summary
fi
fi
@kyhwana
kyhwana / keybase.md
Created March 8, 2014 11:23

Keybase proof

I hereby claim:

  • I am kyhwana on github.
  • I am kyhwana (https://keybase.io/kyhwana) on keybase.
  • I have a public key whose fingerprint is B30C 8C4B A734 513F FC75 41C7 B561 9CE0 3A15 5B13

To claim this, I am signing this object: