Skip to content

Instantly share code, notes, and snippets.

@XBigTK13X
XBigTK13X / pdf-extract-images.py
Last active June 15, 2025 04:13
Extracts images from a PDF and attempts to compose any matching image masks.
#! /usr/bin/python3
# This script requires pdfimage (poppler-utils) and convert (imagemagick)
# Raw images will be written to <OUTPUT_DIR>/15-organized
# Attempts at merging masks and images will be output to <OUTPUT_DIR/30-masked>
# A sample of one image using all compose methods will be written to <OUTPUT_DIR>/25-samples
# Rewritten from https://gist.github.com/bendavis78/ed22a974c2b4534305eabb2522956359
@shellcromancer
shellcromancer / rss-8k-1_05-filings.js
Created January 21, 2024 18:49
Fetch material cybersecurity incidents
let Parser = require('rss-parser');
const url = 'https://www.sec.gov/cgi-bin/browse-edgar?action=getcurrent&CIK=&type=8-K&company=&dateb=&owner=include&start=40&count=40&output=atom'
let parser = new Parser({
headers: {
'User-Agent': 'Company Name admin@company.net'
},
});
(async () => {
@badideasforsale
badideasforsale / create_gha_oidc_in_aws.sh
Last active July 18, 2025 05:21
Create OIDC connection for GitHub Actions to use in AWS
#!/bin/bash
# Script to create OIDC provider for GitHub Actions
# This script creates an OIDC provider in AWS for GitHub Actions to assume roles
# It also creates an IAM role with the appropriate trust policy for the specified repository
set -euo pipefail # Exit on error, undefined variables, and pipe failures
# Color codes for output formatting
readonly RED='\033[0;31m'
@invictus-ir
invictus-ir / CloudTrail.csv
Last active October 10, 2025 15:40
An overview of CloudTrail events that are interesting from an Incident Response perspective
We can make this file beautiful and searchable if this error is corrected: It looks like row 8 should actually have 10 columns, instead of 9 in line 7.
"Initial Access","Execution","Persistence","Privilege Escalation","Defense Evasion","Credential Access","Discovery","Lateral Movement","Exfiltration","Impact"
ConsoleLogin,StartInstance,CreateAccessKey,CreateGroup,StopLogging,GetSecretValue,ListUsers,AssumeRole,CreateSnapShot,PutBucketVersioning
PasswordRecoveryRequested,StartInstances,CreateUser,CreateRole,DeleteTrail,GetPasswordData,ListRoles,SwitchRole,ModifySnapshotAttributes ,RunInstances
,Invoke,CreateNetworkAclEntry,UpdateAccessKey,UpdateTrail,RequestCertificate,ListIdentities,,ModifyImageAttribute,DeleteAccountPublicAccessBlock
,SendCommand,CreateRoute,PutGroupPolicy,PutEventSelectors,UpdateAssumeRolePolicy,ListAccessKeys,,SharedSnapshotCopyInitiated,
,,CreateLoginProfile,PutRolePolicy,DeleteFlowLogs,,ListServiceQuotas,,SharedSnapshotVolumeCreated,
,,AuthorizeSecurityGroupEgress,PutUserPolicy,DeleteDetector,,ListInstanceProfiles,,ModifyDBSnapshotAttribute,
,,AuthorizeSecurityGroupIngress,AddRoleToInstanceProfile,DeleteMembers,,ListBuckets,,PutBucketP
@dafthack
dafthack / azure_client_ids.txt
Created June 16, 2023 11:57
A collection of client IDs that can be used to authenticate a user, and their associated application name that shows up in Azure Sign-In logs.
00b41c95-dab0-4487-9791-b9d2c32c80f2 - Office 365 Management
04b07795-8ddb-461a-bbee-02f9e1bf7b46 - Microsoft Azure CLI
0ec893e0-5785-4de6-99da-4ed124e5296c - Office UWP PWA
18fbca16-2224-45f6-85b0-f7bf2b39b3f3 - Microsoft Docs
1950a258-227b-4e31-a9cf-717495945fc2 - Microsoft Azure PowerShell
1b3c667f-cde3-4090-b60b-3d2abd0117f0 - Windows Spotlight
1b730954-1685-4b74-9bfd-dac224a7b894 - Azure Active Directory PowerShell
1fec8e78-bce4-4aaf-ab1b-5451cc387264 - Microsoft Teams
22098786-6e16-43cc-a27d-191a01a1e3b5 - Microsoft To-Do client
268761a2-03f3-40df-8a8b-c3db24145b6b - Universal Store Native Client
@bradtraversy
bradtraversy / typescript-crash.ts
Last active August 26, 2025 16:33
Basic intro to TypeScript (From YouTube Crash Course)
// Basic Types
let id: number = 5
let company: string = 'Traversy Media'
let isPublished: boolean = true
let x: any = 'Hello'
let ids: number[] = [1, 2, 3, 4, 5]
let arr: any[] = [1, true, 'Hello']
// Tuple
@iann0036
iann0036 / gist:b473bbb3097c5f4c656ed3d07b4d2222
Last active September 10, 2025 14:54
List of expensive / long-term effect AWS IAM actions
acm-pca:CreateCertificateAuthority
aws-marketplace:AcceptAgreementApprovalRequest
aws-marketplace:Subscribe
backup:PutBackupVaultLockConfiguration
bedrock:CreateProvisionedModelThroughput
bedrock:UpdateProvisionedModelThroughput
devicefarm:PurchaseOffering
dynamodb:PurchaseReservedCapacityOfferings
ec2:ModifyReservedInstances
ec2:PurchaseCapacityBlock