Skip to content

Instantly share code, notes, and snippets.

View notdodo's full-sized avatar
☁️
randomASDF' or '1'='1

Edoardo Rosa notdodo

☁️
randomASDF' or '1'='1
View GitHub Profile

Keybase proof

I hereby claim:

  • I am notdodo on github.
  • I am edoardo_rosa (https://keybase.io/edoardo_rosa) on keybase.
  • I have a public key whose fingerprint is 1220 9C4A 9062 019F 3D1D 9B77 BDC2 40F8 81A5 C413

To claim this, I am signing this object:

@notdodo
notdodo / ecfuck.sh
Last active May 13, 2020 19:05
If you have some protected/licensed slides that require a non-open/compatible PDF reader (i.e. Locklizard) you can use this commands to bypass the block.
#!/usr/bin/bash
#
# Author notdodo
#
#
###############################################################################
# SCENARIO ####################################################################
###############################################################################
@notdodo
notdodo / ssround.zsh
Last active May 13, 2020 19:05
Stealth Scan a list of IPs/subnets with Nmap and multiple from random and multiple VPNs to avoid IP filtering.
#!/usr/bin/env zsh
trap ctrl_c INT
#
# author: notdodo
#
# Scan a set of IPs/subnets using multiple VPN profiles
#
# Default values of arguments
local IPS=""
local CREDENTIALS_FILE="./credentials.txt"
@notdodo
notdodo / mashell.py
Last active October 14, 2020 05:45
Execute command using HEX or CHAR encoding. Bypass WAF and IPS filtering enabling RCE using xp_cmdshell: https://knifesec.com/evading-sql-injection-filters-to-get-rce/
#!/usr/bin/env python3
# Injector script to get a pseudo-interactive shell using xp_cmdshell
# Source post:
# Author: notdodo
# https://twitter.com/_d_0_d_o_
#
# USAGE: python3 ./mashell.py "whoami /priv"
#
import binascii
import hashlib
@notdodo
notdodo / win_eventlog.py
Created March 8, 2021 10:15
Basic script to create a entry on the Windows Event Viewer
# pip install pywin32, obviously the script requires admin privs to write to the event logger
import logging, logging.handlers
def main():
ntl = logging.handlers.NTEventLogHandler("notdodo logging test")
logger = logging.getLogger()
logger.addHandler(ntl)
logger.error("This is a test message")
@notdodo
notdodo / .p10k.zsh
Last active July 5, 2021 21:14
Kali Linux's ZSH configuration
# Generated by Powerlevel10k configuration wizard on 2021-07-05 at 12:43 CEST.
# Based on romkatv/powerlevel10k/config/p10k-classic.zsh, checksum 20612.
# Wizard options: nerdfont-complete + powerline, large icons, classic, unicode, light,
# slanted separators, slanted heads, flat tails, 2 lines, dotted, left frame, compact,
# many icons, concise, transient_prompt, instant_prompt=verbose.
# Type `p10k configure` to generate another config.
#
# Config for Powerlevel10k with classic powerline prompt style. Type `p10k configure` to generate
# your own config based on it.
#
@notdodo
notdodo / settings.json
Last active July 24, 2021 09:47
Windows Terminal Settings
{
"$schema": "https://aka.ms/terminal-profiles-schema",
// Add custom actions and keybindings to this array.
// To unbind a key combination from your defaults.json, set the command to "unbound".
// To learn more about actions and keybindings, visit https://aka.ms/terminal-keybindings
"actions": [
// Copy and paste are bound to Ctrl+Shift+C and Ctrl+Shift+V in your defaults.json.
// These two lines additionally bind them to Ctrl+C and Ctrl+V.
// To learn more about selection, visit https://aka.ms/terminal-selection
{
@notdodo
notdodo / notdodo-burp.json
Last active July 28, 2021 12:28
Burp Suite User Configuration
{
"user_options":{
"connections":{
"platform_authentication":{
"credentials":[],
"do_platform_authentication":true,
"prompt_on_authentication_failure":false
},
"socks_proxy":{
"dns_over_socks":false,
@notdodo
notdodo / fortissl_parse_dump.py
Last active September 19, 2021 16:12
Dumb script to bulk parse the output of CVE-2018-13379 (https://gist.github.com/code-machina/bae5555a771062f2a8225fd4731ae3f7) (SSLVPN Fortigate)
import re
import mmap
CHECKING = re.compile("\[Checking: .*\]\n")
IPADDR = re.compile(
r"((?:(0|1)\d{2}|2[0-4]\d|25[0-5]|\d{1,2})\.(?:(0|1)\d{2}|2[0-4]\d|25[0-5]|\d{1,2})\.(?:(0|1)\d{2}|2[0-4]\d|25[0-5]|\d{1,2})\.(?:(0|1)\d{2}|2[0-4]\d|25[0-5]|\d{1,2}))"
)
DOTS = re.compile(".*\.{2,}.*")
@notdodo
notdodo / list.txt
Last active November 7, 2021 21:57
List of `username&&password` collected from personal honeypots
&&
0&&0
1&&1
119.18.20.137&&22022
1234&&1234
12345&&12345
154.29.178.51&&22
192.185.196.181&&22
24online&&24online
2Wire&&2Wire