packetchef

from urllib2 import unquote

# Quoted string seen in POST requests attempting to use PHP file includes
quotedString = (
				"%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69"
				"%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66"
				"%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F"
				"%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+"
				"%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75"
				"%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E"

packetchef

# From https://gist.github.com/revolunet/2412240

def xor_crypt_string(data, key, encode=False, decode=False):
    from itertools import izip, cycle
    import base64
    if decode:
        data = base64.decodestring(data)
    xored = ''.join(chr(ord(x) ^ ord(y)) for (x,y) in izip(data, cycle(key)))
    if encode:
        return base64.encodestring(xored).strip()

packetchef

import optparse
import sys

global debug

progDesc = (
    'Welcome to %prog.  It\'s meant for frobbing foozles, and otherwise'
    'making for better frognosticators.'
)

packetchef

def prettyDictionary(**kwargs):
    for name, value in kwargs.items():
        print('{name} :: {value}'.format(name=name, value=value))


import urllib2
import simplejson as json
url = 'http://ipinfo.io/json'
ipinfo = urllib2.urlopen(url).read()
jipinfo = json.loads(ipinfo)

packetchef

#!/bin/bash
SERVER="https://splunk_server:8089"
QUERY="search sourcetype=dhcp earliest=-4h"
SEARCH_JOBS_URI="services/search/jobs"

SEARCH=$(curl -s -k "$SERVER/$SEARCH_JOBS_URI" -d search="$QUERY")
JOB_SID=$(sed -E 's/^.*<sid>(.*)<\/sid>.*/\1/' <<< $SEARCH)
echo "JOB_SID: $JOB_SID"

job_done() {

packetchef

#!/bin/bash
SERVER="https://splunk_server:8089"
QUERY="search sourcetype=dhcp earliest=-4h"
SEARCH_URI="services/search/jobs/export"

RESULTS=$(curl -s -k "$SERVER/$SEARCH_URI" --data-urlencode search="$QUERY" -d output_mode=json)
echo $RESULTS

packetchef

class myVariableClass:
	def __init__(self, name, **kwargs):
		self.name = name
    self.classType = 'Variable class'
		
		for key, value in kwargs.items():
			setattr(self, key, value)

from pprint import pprint
myVar = myVariableClass('test class', string1='abc', int1=999, string2='end this')

packetchef

import string
rot13 = string.maketrans(
	"ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz", 
	"NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm"
)

encodedString = string.translate('Hypatia', rot13)
decodedString = string.translate(encodedString, rot13)

print('Encoded string is {string}'.format(string=encodedString))

packetchef

# Rumor has it that in newer releases of Python v3, ipaddr objects are not iterable
import ipaddr
import hashlib

salt = 'NN'
subnet = ipaddr.IPNetwork('192.168.100.0/24')
for ip in subnet:
  # Try md5 or sha512
  maskedIP = hashlib.md5(str(ip) + salt).hexdigest()
  print('{ip:<15} :: {maskedIP}'.format(ip=ip, maskedIP=maskedIP))

packetchef

# Future print lets us easily remove trailing newlines
from __future__ import print_function
import hashlib
i=0
salt = "N"
while i < 5000:
	print(hashlib.md5('thisismystring' + (salt * i)).hexdigest(), end='')
	i += 1