diyinfosec

https://unix.stackexchange.com/questions/236920/1-what-does-this-sed-action-mean
\([^"]*\) defines a group of characters, the group is actually the found contents between the two braces (), the braces need to be escaped hence \( and \)

\1 is the contents of the first group
There could be several groups defined using multiple sets of brace pairs, they are numbered incrementally and each one can be referenced as \n (e.g. \1, \2, \3 etc) hence the name: backreference.

diyinfosec

import csv
import json
with open('splunk.csv', mode='r') as infile:
    reader = csv.DictReader(infile)
    for rows in reader:
        print(json.dumps(rows))

diyinfosec

Simple macro with vim:
Usecase: Join evey other line in a file to the previous one. 
We can do this easily using macros:
1. start recording a macro 'q': qqJjq
2. replay the macro 'q' 500 times: 500@q

(Actually it is not a macro called 'q', it is a named register called 'q'. instead of interactively fill that register as in (1), you could also do :let @q = "Jj" and then do 2.)
Source: https://superuser.com/questions/168942/how-to-join-every-second-line-in-vim

diyinfosec

https://docs.microsoft.com/en-us/previous-versions/ms867086(v=msdn.10)?redirectedfrom=MSDN

The Cryptography API, or How to Keep a Secret
01/12/2010
22 minutes to read
 

Robert Coleridge
Microsoft Developer Network Technology Group

diyinfosec

from timeit import default_timer as timer
from binascii import b2a_hex

#- Config variables 
filename="memory.dmp"
aes_key_size=32

#- Variables related to file processing
file_offset=0;
total_keys_found = 0;

diyinfosec

from timeit import default_timer as timer
from binascii import b2a_hex,hexlify


#- Goto "Memory dump processing" second section

#- AES key schedule calculation taken from: https://www.alexrhodes.io/blog/post/30/
class AesKeySchedule:
    #AES S-box
    s_box = [

diyinfosec

from timeit import default_timer as timer
from binascii import b2a_hex

#- Config variables 
filename="memory.dmp"
aes_key_size=32
min_distinct_bytes=10

#- Variables related to file processing
file_offset=0;

diyinfosec

from timeit import default_timer as timer
from binascii import b2a_hex,hexlify


#- First half of the code covers AES schedule calculation. Memory dump processing, line 150 onwards. 

#- AES key schedule calculation taken from: https://www.alexrhodes.io/blog/post/30/
class AesKeySchedule:
    #AES S-box
    s_box = [

diyinfosec

import re

#- Name of the file/drive letter to scan
#input_file_name="C:\\memory.dmp"
input_file_name="memory.dmp"
key_len=32


#- Open the input file
with open(input_file_name, "rb") as f:

diyinfosec

#- Author: Ramprasad R 
#- Purpose: This is a simple script I wrote to test how many hardlinks I can create for a file. 
#- Language:  Powershell

<#
Question:
How many NTFS attributes can a file have?
Hypothesis:
In the MFT, the Attribute ID field is 2 bytes = 16 bits = 2^16 = 65536
Technically I should be able to create a file with 65536 attributes