Skip to content

Instantly share code, notes, and snippets.

$cert = '''-----BEGIN CERTIFICATE-----
MIIFNzCCBB+gAwIBAgIQBTCLdqwuFbKXIPtDlfZfODANBgkqhkiG9w0BAQUFADBv
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMS4wLAYDVQQDEyVEaWdpQ2VydCBBc3N1cmVkIElEIENv
ZGUgU2lnbmluZyBDQS0xMB4XDTE5MDMxOTAwMDAwMFoXDTIyMDMyMzEyMDAwMFow
gYIxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEXMBUGA1UEBxMOUmVkd29vZCBT
aG9yZXMxGzAZBgNVBAoTEk9yYWNsZSBDb3Jwb3JhdGlvbjETMBEGA1UECxMKVmly
dHVhbGJveDEbMBkGA1UEAxMST3JhY2xlIENvcnBvcmF0aW9uMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtqeTgikxn1Dwcv2BY6K+LyCOciwaMraBGXkY
VbhdOSkyySP5EUm798iHgU1cj/yKS1e2c0YOJnVZlTeAzyGZp9TiVO4HPNO2Q0cN
@nopslider
nopslider / gist:84266bafc0dc0b7c28ae9efe490d60bf
Created April 12, 2019 12:17
Get all servers without ad tools
$Search = [adsisearcher]"(&(&(&(&(samAccountType=805306369))(objectCategory=computer)(operatingSystem=Windows Server*))))"
(($Search.findall()).properties).dnshostname
import re
import sys
def luhn_checksum(card_number):
def digits_of(n):
return [int(d) for d in str(n)]
digits = digits_of(card_number)
odd_digits = digits[-1::-2]
even_digits = digits[-2::-2]
checksum = 0
checksum += sum(odd_digits)
#!/bin/bash
find / -type f | egrep -v '^/(proc|dev|devices)/' | xargs -i egrep -l '\b4[0-9]{15}\b' /dev/null {} > search.out 2> search.err
while read p ; do
./panscan.py $p >> search.detail
done < search.out
@nopslider
nopslider / list_nessus_hosts.py
Created August 2, 2018 09:41
List information about hosts in a Nessus scan
#!/usr/bin/python3
import xml.etree.ElementTree as ET
import argparse
parser = argparse.ArgumentParser()
parser.add_argument("nessusfile")
args = parser.parse_args()
nessus = ET.parse(args.nessusfile)
@nopslider
nopslider / mssql_version_audit.py
Created August 2, 2018 09:23
Audit versions of MSSQL (credentialed check)
#!/usr/bin/python3
import xml.etree.ElementTree as ET
import argparse
import re
parser = argparse.ArgumentParser()
parser.add_argument("nessusfile")
args = parser.parse_args()
@nopslider
nopslider / nessus_parse.py
Created August 2, 2018 09:18
Parse Nessus Files
#!/usr/bin/python3
import xml.etree.ElementTree as ET
import argparse
import re
parser = argparse.ArgumentParser()
parser.add_argument("nessusfile")
parser.add_argument("-s","--severitylevel",type=int,choices=[0,1,2,3,4],default=1,help="Filter vulnerabilities of this severity level and lower")
parser.add_argument("-r","--regex",help="Filter vulnerabilities matching this regex (e.g. '/MS[0-9]{2}-[0-9]{3}/i')",default='.*')
@nopslider
nopslider / process_qradar_traffic.py
Created July 25, 2018 08:37
Do a count of flows from QRadar
#!/usr/bin/python3
'magnitude,protocol,protocolName,startTime,stopTime,startDateTime,stopDateTime,destIp,destinationPort,srcIp,sourcePort,dstPortInvalid,srcPortInvalid,customProps,sourceV6Ip,destinationV6Ip,tLVProperties,domainID,domainName,categoryDescription,qid,eventName,category,flowIdentifier,appId,compoundAppID,appName,totalDestinationBytes,totalBytes,totalDestinationPackets,severity,credibility,relevance,sensorInterfaceId,flowSensorName,flowInterfaceName,totalSourceBytes,totalSourcePackets,mPCEvent,firstPacketTime,lastPacketDateTime,sourcePayloadAsBase64,sourcePayloadAsHexOneLine,sourcePayloadAsUTF,destinationPayloadAsBase64,destinationPayloadAsHexOneLine,destinationPayloadAsUTF,icmpCode,icmpType,icmpTypeDescription,flowType,flowTypeDescription,sourceTOS,destinationTOS,destinationDSCP,destinationPrecedence,sourceDSCP,sourcePrecedence,direction,directionDescription,destinationTCPFlags,sourceTCPFlags,sourceTCPFlagsDescription,destinationTCPFlagsDescription'
import csv
#infile = './export.csv.head'
inf
@nopslider
nopslider / qualys_compare.py
Last active October 14, 2018 08:06
Qualys Compare
#!/usr/bin/python3
import xml.etree.ElementTree as ET
import argparse
import ipaddress
parser = argparse.ArgumentParser()
parser.add_argument("firstscan")
parser.add_argument("secondscan")
parser.add_argument("-s","--severitylevel",type=int,choices=[0,1,2,3],default=1,help="Filter vulnerabilities of this severity level and lower")
args = parser.parse_args()
@nopslider
nopslider / wordmagicmarker.py
Created April 26, 2017 17:20
Replace a beacon in a Word file (.doc)
#python3 wordmagicmarker.py test.doc geoff.jones@cyberis.co.uk > test1.doc
import sys
import hashlib
marker = "A"*32
marker8 = bytes(marker,'utf-8')
marker16 = bytes(marker,'utf-16-be')
email = sys.argv[2].encode('utf-8')
ehash = hashlib.md5(email).hexdigest()
ehash8 = bytes(ehash,'utf-8')