Skip to content

Instantly share code, notes, and snippets.

import argparse
class RandInt:
def __init__(self, seed):
self.seed = seed
def rand_int_modulus(self, modulus):
ix = self.seed
ix = 16807*(ix % 127773) - 2836*(ix / 127773) & 0xFFFFFFFF
import hashlib
from datetime import datetime, timedelta
import struct
import argparse
def get_seed(seq_nr, date):
key = "\x01\x05\x19\x35"
seq_nr = struct.pack('<I', seq_nr)
year = struct.pack('<H', date.year)
month = struct.pack('<H', date.month)
@7h3rAm
7h3rAm / dga_shiz.py
Last active August 29, 2015 14:21 — forked from baderj/dga_shiz.py
import argparse
def get_domains(nr, how_many):
bases = {
1: {
'length': 7,
'tld': 'com',
'key': '1676d5775e05c50b46baa5579d4fc7',
'base': 0x45AE94B2
},
import argparse
from datetime import datetime
seed_const = 42
days_period = 16
nr_of_domains = 64
third_lvl_min_len = 8
third_lvl_max_len = 15
class Rand:
@7h3rAm
7h3rAm / dga.py
Last active August 29, 2015 14:21 — forked from baderj/dga.py
"""
generate domains according to:
- https://www.endgame.com/blog/malware-with-a-personal-touch.html
- http://www.rsaconference.com/writable/presentations/file_upload/br-r01-end-to-end-analysis-of-a-domain-generating-algorithm-malware-family.pdf
requires words1.txt and words2.txt
"""
import time
from datetime import datetime
import argparse
@7h3rAm
7h3rAm / k10.py
Last active August 29, 2015 14:07 — forked from 9b/k10.py
import datetime, re, difflib
def k10(stack):
if len(stack) <= 1:
return
checkHashes, checkDuplicates, checkDelta, checkName = True, True, True, True
score, dCount, fCount, deltaScore, fnameScore, chainAverage = 65, 0, 0, 0, 0, 0
duplicates, dChain, fChain, features = [], [], [], [ 'valid_filenames' ]
Verifying that +7h3ram is my Bitcoin username. You can send me #bitcoin here: https://onename.io/7h3ram
@7h3rAm
7h3rAm / sap.cnf
Last active October 3, 2020 04:21
Shellcode Analysis Pipeline (SAP)
[defaults]
search = dos
pgtpath = /home/ankur/toolbox/PCAP-Generation-Tools/pgt.py
shellstormpath = /home/ankur/scripts/shell-storm-api.py
exploitdbpath =
metasploitpath =
emuprofilesize = 10240
@7h3rAm
7h3rAm / minips.py
Created April 17, 2014 11:07
A minimal IPS
#!/usr/bin/env python
import sys
import re
import datetime, time
import argparse
import nids
end_states = (nids.NIDS_CLOSE, nids.NIDS_TIMEOUT, nids.NIDS_RESET)
@7h3rAm
7h3rAm / shell.c
Created September 1, 2013 19:39 — forked from parse/shell.c
/* Compile with: g++ -Wall –Werror -o shell shell.c */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>