Seamus Tuohy seamustuohy
PaulSec
/ findsubdomains.py
Last active
March 9, 2019 11:44
Python utility for https://findsubdomains.com/
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import requests | |
| import sys | |
| from bs4 import BeautifulSoup | |
| import json | |
| import re | |
| def sanitize_data(data): | |
| return data.replace('\r\n', '').replace('\n', '').replace(' ', '').replace(' ', '') | |
| if len(sys.argv) < 2: |
jaredhaight
/ givingbacktoinfosec.md
Last active
January 28, 2018 13:34
Giving Back to Infosec Talk Resources
GelosSnake
/ crypto-Miners_public_pools_sig.txt
Last active
April 8, 2022 10:44
suricata crypto-miner pool rules
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #Suricata 3.2+ | |
| alert dns $HOME_NET any -> any any (msg:"Observed DNS Query to public CryptoMining pool Domain (pool.minergate.com)"; dns_query; content:"pool.minergate.com"; nocase; isdataat:!1,relative; classtype:trojan-activity; sid:20000000; rev:1;) | |
| #Suricata 1.3+ | |
| alert udp $HOME_NET any -> any 53 (msg:"Observed DNS Query to public CryptoMining pool Domain (pool.minergate.com)"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|04|pool|09|minergate|03|com|00|"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:20000000; rev:1;) | |
| #Suricata 3.2+ | |
| alert dns $HOME_NET any -> any any (msg:"Observed DNS Query to public CryptoMining pool Domain (pool.minexmr.com)"; dns_query; content:"pool.minexmr.com"; nocase; isdataat:!1,relative; classtype:trojan-activity; sid:20000001; rev:1;) |
PaulSec
/ certstream_watchdog_paypal.py
Created
November 6, 2017 15:27
certstream utility to retrieve paypal and few other fraud keywords
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import certstream | |
| keywords = ['paypal', 'paypol'] | |
| def extract_domains(domains): | |
| res = [] | |
| for domain in domains: | |
| for keyword in keywords: | |
| if keyword in domain: | |
| res.append(domain) |
ammarshah
/ all_email_provider_domains.txt
Last active
June 3, 2024 21:04
A list of all email provider domains (free, paid, blacklist etc). Some of these are probably not around anymore. I've combined a dozen lists from around the web. Current "major providers" should all be in here as of the date this is created.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 0-mail.com | |
| 007addict.com | |
| 020.co.uk | |
| 027168.com | |
| 0815.ru | |
| 0815.su | |
| 0clickemail.com | |
| 0sg.net | |
| 0wnd.net | |
| 0wnd.org |
jessfraz
/ boxstarter.ps1
Last active
April 11, 2024 16:02
Boxstarter Commands for a new Windows box.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Description: Boxstarter Script | |
| # Author: Jess Frazelle <jess@linux.com> | |
| # Last Updated: 2017-09-11 | |
| # | |
| # Install boxstarter: | |
| # . { iwr -useb http://boxstarter.org/bootstrapper.ps1 } | iex; get-boxstarter -Force | |
| # | |
| # You might need to set: Set-ExecutionPolicy RemoteSigned | |
| # | |
| # Run this boxstarter by calling the following from an **elevated** command-prompt: |
scrapbird
/ unpack_locky.py
Created
April 16, 2017 02:53
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| import r2pipe | |
| r2 = r2pipe.open('http://192.168.100.64:1337') | |
| def cont(): | |
| print(r2.cmd('dc')) |
williballenthin
/ hint_calls.py
Last active
April 4, 2024 03:40
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ''' | |
| IDA plugin to display the calls and strings referenced by a function as hints. | |
| Installation: put this file in your %IDADIR%/plugins/ directory. | |
| Author: Willi Ballenthin <william.ballenthin@fireeye.com> | |
| Licence: Apache 2.0 | |
| ''' | |
| import idc | |
| import idaapi | |
| import idautils |
Neo23x0
/ annotations.xml
Last active
October 22, 2023 12:14
Sources for APT Groups and Operations Search Engine
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?xml version="1.0" encoding="UTF-8"?> | |
| <Annotations start="0" num="171" total="171"> | |
| <Annotation about="www.bussink.net/*" timestamp="0x0005d7bc4022b026" href="ChF3d3cuYnVzc2luay5uZXQvKhCm4IqBxPf1Ag"> | |
| <Label name="_cse_turlh5vi4xc"/> | |
| <AdditionalData attribute="original_url" value="https://www.bussink.net/"/> | |
| </Annotation> | |
| <Annotation about="*.thedfirreport.com/*" timestamp="0x0005d76dd5f8679d" href="ChUqLnRoZWRmaXJyZXBvcnQuY29tLyoQnc_hr93t9QI"> | |
| <Label name="_cse_turlh5vi4xc"/> | |
| <AdditionalData attribute="original_url" value="https://thedfirreport.com/"/> | |
| </Annotation> |
hardiksondagar
/ instagramFollowerScrapper.js
Last active
June 10, 2023 09:25
— forked from suprememoocow/intercept.js
Instagram follower web scrapper.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /** | |
| * | |
| * Instagram Follower Web Scrapper | |
| * | |
| * Steps to use. | |
| * 1. Open instagram user's profile in browser https://www.instagram.com/tvfpitchers/ | |
| * 2. Open console ( press F12 in chrome ) and paste all the code below | |
| * 3. Click on followers button and load all the followers | |
| * 4. Call function downloadAsCsv() by writing "downloadAsCsv()" in console to download csv file containing user's all the followers . | |
| * |
NewerOlder