Skip to content

Instantly share code, notes, and snippets.

View chapinb's full-sized avatar

Chapin Bryce chapinb

View GitHub Profile
@chapinb
chapinb / developmet_resources.md
Last active August 19, 2024 13:42
Interested in writing code?

Here are some free resources to improve your software development skills, in no particular order.

Programming

  • roadmap.sh
    • Free learning paths across multiple domains. The "Start Here" on the top menu bar is a great place to start.
  • Git Internals
    • Learn how git works under the hood. Not only is it the most common version control system, it has a well thought out interface and backend.
  • Practical Python Course
  • David Beazley's popular python course, setting a foundation in using Python for a variety of tasks.
@chapinb
chapinb / honeypot-to-moloch.sh
Created February 15, 2020 12:40
Script to pull honeypot PCAP data into Moloch
#!/bin/bash
## Please insert the appropriate User and IP address values
## You may also need to edit the path to where your PCAPs
## exist on the remote system
echo ===== Pulling remote pcap data
rsync -a <USER>@<IP>:/data/rdp.*.pcap* /data/pcap/
echo rsync exit code: $?
## This script is available at:
@chapinb
chapinb / Dockerfile
Created January 2, 2020 02:24
Elasticsearch 7.5.1 for ARMHF / Raspberry Pi
FROM adoptopenjdk/openjdk11:slim
RUN apt update &&\
apt install -y curl nginx
# SETUP NGINX PROXY
COPY default.nginx.conf /etc/nginx/sites-available/default
# SETUP ELASTIC 7.5.1
@chapinb
chapinb / prep-report.sh
Last active November 23, 2019 20:52
Quick script to run bro against a pcap capturing
#!/usr/bin/env bash
# Tested on Debian 10 (Buster)
# Make a report folder
outdir=bro-`date +%FT%H-%M-%S`
mkdir $outdir
# Generate our reports with bro in the report folder
cd $outdir
@chapinb
chapinb / .shell_aliases
Created July 18, 2019 12:24
Common Aliases
# Homebrew, install at brew.sh
alias binfo='brew info'
alias bupdate='brew update'
alias bupgrade='brew upgrade'
alias bsearch='brew search'
# Git
alias gitu='git add -u'
alias gitc='git commit'
alias gits='git status -uno'
@chapinb
chapinb / ntuser_trustrecords.py
Created July 3, 2019 21:24
Checking NTUSER.DAT files for documents with enabled macros
# -*- coding: utf-8 -*-
"""Script to check the TrustRecords key for documents with enabled macros
Prior research/tools:
- http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html
- http://windowsir.blogspot.com/2012/07/links-and-updates.
Other tools support parsing this key (ie RegRipper plugin TrustRecords) though
it's always useful to have more options to parse an artifact. This is just
another take on extracting value from this registry key with the hope of
@chapinb
chapinb / response.json
Created January 21, 2019 15:22
Sample API Response
{
"query_seconds": 0.114051,
"records": {
"13.52.4.25": {
"message": "",
"results": [
{
"cidr": "13.52.0.0/16",
"first_collected": "2017-09-08T16:27:01",
"last_collected": "2019-01-13T08:00:01",
$ fgrep Invalid\ user auth.log | head -n 5 | awk '{ print $10 }' | ursort
3 180.211.137.8
2 188.165.201.89
alias usort='sort | uniq -c | sort -n' # Normal sort
alias ursort='sort | uniq -c | sort -rn' # Reverse sort
$ fgrep Invalid\ user auth.log | head -n 5 | awk '{ print $10 }' | sort | uniq -c | sort -rn
3 180.211.137.8
2 188.165.201.89