Skip to content

Instantly share code, notes, and snippets.

View vagelim's full-sized avatar

vagelim vagelim

View GitHub Profile
@vagelim
vagelim / gist:cdd54498537c60da31d1c0fa419963a3
Created June 18, 2019 20:33 — forked from tlrobinson/gist:1073865
Autocomplete Makefile targets. Add this to your shell config file.
complete -W "\`grep -oE '^[a-zA-Z0-9_-]+:([^=]|$)' Makefile | sed 's/[^a-zA-Z0-9_-]*$//'\`" make
@vagelim
vagelim / postgres_queries_and_commands.sql
Created July 3, 2018 18:48 — forked from rgreenjr/postgres_queries_and_commands.sql
Useful PostgreSQL Queries and Commands
-- show running queries (pre 9.2)
SELECT procpid, age(query_start, clock_timestamp()), usename, current_query
FROM pg_stat_activity
WHERE current_query != '<IDLE>' AND current_query NOT ILIKE '%pg_stat_activity%'
ORDER BY query_start desc;
-- show running queries (9.2)
SELECT pid, age(query_start, clock_timestamp()), usename, query
FROM pg_stat_activity
WHERE query != '<IDLE>' AND query NOT ILIKE '%pg_stat_activity%'
@vagelim
vagelim / gist:d1209f5075e20e46b68b7193544f29fc
Created May 22, 2017 22:24
Get a mapping of containers to host for service discovery via DNS
docker network inspect bridge | jq '.[].Containers[] | "\(.Name)", "\(.IPv4Address)"' | sed -e '$!N;s/\n/ /' -e 's/"//g' -e 's,/16,,g'
@vagelim
vagelim / agent_version.sh-session
Last active May 22, 2017 13:57 — forked from miketheman/agent_version.sh-session
Retrieve metadata about systems from Datadog
# Ensure you have `jq` installed - http://stedolan.github.io/jq/
$ brew install jq
...
/usr/local/Cellar/jq/1.4: 15 files, 748K, built in 9 seconds
# Grab your API_KEY and create an APPLICATION_KEY from https://app.datadoghq.com/account/settings#api
$ export API_KEY=aaabbbccc
$ export APPLICATION_KEY=111222333
$ curl -s "https://app.datadoghq.com/reports/v2/overview?with_meta=true&api_key=$DD_API&application_key=$DD_APP" \
@vagelim
vagelim / fuckumbreon.c
Created October 31, 2016 14:51
GID inconsistency bruteforcer This can be used to detect LD_PRELOAD rootkit that hide fds, procs and files based on GID Since GID is an unsigned int, it is finite and thus bruteforceable, however it might take a while. This took less than 20mins on my system, this may vary based on your setup. NOTE: the rkit could detect it is under GID brutefor…
/*
GID inconsistency bruteforcer
This can be used to detect LD_PRELOAD rootkit that hide fds, procs and files based on GID
Since GID is an unsigned int, it is finite and thus bruteforceable, however it might take a while.
This took less than 20mins on my system, this may vary based on your setup.
NOTE: the rkit could detect it is under GID bruteforce attack and switch GIDs, however this is not easy to perform.
This will detect Umbreon and other GID based rkits
@vagelim
vagelim / rdwr.py
Created October 31, 2016 14:39 — forked from pakt/rdwr.py
Direct read/write access to Python's memory
#
# read/write access to python's memory, using a custom bytearray.
# some code taken from: http://tinyurl.com/q7duzxj
#
# tested on:
# Python 2.7.10, ubuntu 32bit
# Python 2.7.8, win32
#
# example of correct output:
# inspecting int=0x41424344, at 0x0228f898
<?xml version="1.0" encoding="UTF-8"?>
<vxml version = "2.1">
<form>
<record name="message" beep="true" maxtime="60s">
<prompt>Please leave your message after the beep, then press any key.</prompt>
</record>
<block>
<prompt>Here's what you recorded <value expr="message"/>.</prompt>
</block>
<block>
@vagelim
vagelim / activemq_58.yaml
Created September 28, 2016 21:21
activemq i hate you
instances:
- host: localhost
port: 1099
# user: username
# password: password
# process_name_regex: .*process_name.* # Instead of specifying a host, and port. The agent can connect using the attach api.
# # This requires the JDK to be installed and the path to tools.jar to be set below.
# tools_jar_path: /usr/lib/jvm/java-7-openjdk-amd64/lib/tools.jar # To be set when process_name_regex is set
# name: activemq_instance
# # java_bin_path: /path/to/java # Optional, should be set if the agent cannot find your java executable
[default]
access_token =
add_encoding_exts =
add_headers =
bucket_location = US
ca_certs_file =
cache_file =
check_ssl_certificate = True
check_ssl_hostname = True
cloudfront_host = cloudfront.amazonaws.com
@vagelim
vagelim / changes_nova.conf
Created August 9, 2016 13:01
add this to your nova.conf, restart Nova
[oslo_messaging_notifications]
driver = messaging
notification_topics = notifications
notify_on_state_change = vm_and_task_state
instance_usage_audit_period = hour
instance_usage_audit = True
default_notification_level = INFO
notify_api_faults = true