Skip to content

Instantly share code, notes, and snippets.

View scusi's full-sized avatar
🏠
Working from home

Florian Walther scusi

🏠
Working from home
View GitHub Profile
@scusi
scusi / gifExeExtract.go
Created March 30, 2017 13:49
extract payload exe from downloaded gif as Trojan-Ransom.Win32.Foreign does
package main
import (
"bufio"
"bytes"
"container/ring"
"encoding/hex"
"flag"
"fmt"
"io/ioutil"
@scusi
scusi / Parse.go
Created October 29, 2014 11:32
Paresing FritzBox BPjM Files useing bpjm module in golang
// tool that uses my bpjm library to load and parse a BPJM File from a FritzBox
package main
import(
"github.com/scusi/bpjm"
"fmt"
"os"
)
func main(){
@scusi
scusi / bpjm.go
Last active August 29, 2015 14:08
golang module to handle BPjM Lists
// go library to scope with the BPjM Censorship list
package Bpjm
import (
"net/url"
"regexp"
"crypto/md5"
"strings"
"bytes"
@scusi
scusi / parseFritzBpjmFile.go
Created October 29, 2014 11:23
parse FritzBox BPJM Files with go
// parse a FritzBox Bpjm File
package main
import (
"os"
"fmt"
"bytes"
"io"
"io/ioutil"
@scusi
scusi / dns_xor.go
Last active August 29, 2015 14:08
encode/decode FrameworkPOS Malware DNS exfiltrated data
// domain data encoding/decoding algo for FrameworkPOS Malware DNS-Tunneling Variant,
// as described on:
// https://blog.gdata.de/artikel/neue-variante-von-frameworkpos-schoepft-daten-ueber-dns-anfragen-ab/
//
package main
import(
"fmt"
"os"
@scusi
scusi / ConvertBinaryBpjmData.sh
Last active August 29, 2015 14:07
convert binary bpjm data from FritzBox routers into text files
#!/bin/sh
#
# USAGE:
# $> ./ConvertBinaryBpjmData.sh bpjm.data
#
RAWFILE=$1
OUTFILE=`strings $RAWFILE | head -n 1`
od -t x1 -An -j 64 $RAWFILE | tr -d '\n ' > $OUTFILE