Patrick-Kelley

Patrick-Kelley

#fields	indicator	indicator_type	meta.source	meta.do_notice	meta.desc
forms.office3.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING
forms.office8.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING
forms.officea.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING
forms.officek.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING
forms.officep.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING
forms.officec.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING
forms.officed.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING
forms.office2.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING
forms.office4.com	Intel::DOMAIN	CPS-CTI	F	OFFICE-PHISHING

Patrick-Kelley

$drive = "C:\"
$days = 7  # Number of days to consider as "recent"

# Download the wordlist file
$wordlistUrl = "https://raw.githubusercontent.com/CriticalPathSecurity/Zeek-Intelligence-File-Names/main/Zeek-Intelligence-File-Names.txt"
$wordlistPath = "$env:TEMP\Zeek-Intelligence-File-Names.txt"
Invoke-WebRequest -Uri $wordlistUrl -OutFile $wordlistPath

# Read the wordlist file into an array
$wordlist = Get-Content -Path $wordlistPath

Patrick-Kelley

import subprocess

def run_nmap(cidr_block, output_file):
    command = f"nmap -A -oX {output_file} {cidr_block}"
    try:
        subprocess.check_call(command, shell=True)
        print(f"Nmap scan results saved to: {output_file}")
    except subprocess.CalledProcessError as e:
        print(f"Error executing Nmap command: {e}")

Patrick-Kelley

# Python script to convert subnets to lists of IP
# Prompt the user to input a subnet in CIDR notation
subnet = input("Enter the subnet in CIDR notation (e.g. 192.168.1.0/24): ")

# Split the subnet into IP address and CIDR mask
ip_addr, cidr = subnet.split("/")
cidr = int(cidr)

# Calculate the netmask
netmask = (0xffffffff << (32 - cidr)) & 0xffffffff

Patrick-Kelley

######################################################
# Bro script to parse (MS-SQL) TDS data streams and  #
# extract SQL statements and TDS7 login information. #
#                                                    #
# parsetds.bro v2014.01.27                           #
# https://malwaremusings.com/scripts/parsetds.bro     #
#                                                    #
# usage:                                             #
#   Place the script in $BRO_HOME/share/bro/site     #
#   and either load it from local.bro with           #

Patrick-Kelley

- name: Remove MS-MSDT Key
  hosts: win-test
  gather_facts: false

  tasks:
    - win_command: powershell.exe -
      args:
        stdin: reg export HKCR\ms-msdt c:\msdt-export.reg

    - win_command: powershell.exe -

Patrick-Kelley

aircrack-ng -w 000webhost.txt,10k_most_common.txt,10_million_password_list_top_1000000.txt,500-worst-passwords.txt,adobe100.txt,alleged-gmail-passwords.txt,Ashley_Madison.txt,Basic_Spanish_List.txt,best1050.txt,bt4-password.txt,cain.txt,carders.cc.txt,common-passwords-win.txt,conficker.txt,darkc0de.txt,elitehacker.txt,english.txt,faithwriters.txt,hak5.txt,honeynet-nocount.txt,hotmail.txt,john.txt,KeyboardCombinations.txt,korelogic-password.txt,MostPopularLetterPasses.txt,myspace.txt,password-permutations.txt,passwords_youporn2012.txt,rockyou.txt,singles.org.txt,SplashData-2015.txt,Sucuri_Top_Wordpress_Passwords.txt,twitter-banned.txt,wordpress_attacks_july2014.txt

Patrick-Kelley

Keybase proof

I hereby claim:

• I am logikphreak on github.
• I am pkelley (https://keybase.io/pkelley) on keybase.
• I have a public key whose fingerprint is A16B 1865 26EC 7D2D 8769 A55E 7B9F D7BB 16EB 3469

To claim this, I am signing this object:

Patrick-Kelley

# If you want dnsmasq to listen for DHCP and DNS requests only on
# specified interfaces (and the loopback) give the name of the
# interface (eg eth0) here.
# Repeat the line for more than one interface.
interface=at0
#interface=wlan0mon
#interface=wlan0

# Uncomment this to enable the integrated DHCP server, you need
# to supply the range of addresses available for lease and optionally