Skip to content

Instantly share code, notes, and snippets.

View ericlaw1979's full-sized avatar
💭
Working on Microsoft Web Defense

Eric Lawrence ericlaw1979

💭
Working on Microsoft Web Defense
View GitHub Profile
@ericlaw1979
ericlaw1979 / mutz.cs
Created December 2, 2022 21:09
csc.exe mutz.cs
using System;
using System.IO;
using System.Runtime.InteropServices;
namespace MUTZ
{
[ComImport, GuidAttribute("79EAC9EE-BAF9-11CE-8C82-00AA004BA90B")]
[InterfaceTypeAttribute(ComInterfaceType.InterfaceIsIUnknown)]
public interface IInternetSecurityManager
{
@ericlaw1979
ericlaw1979 / guetzli.reg
Last active June 24, 2022 00:16
Add guetzli JPEG Optimizer to Fiddler's ImageView context menu.
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Fiddler2\ImagesMenuExt\&JPEGGuetzli]
"Command"="C:\\Users\\ericlaw\\Documents\\Fiddler2\\scripts\\Tools\\guetzli_windows_x86-64.exe"
"Parameters"="{in} {out:jpg}"
"Types"="image/jpeg"
accounts_image_fetcher 98658519
adb_client_socket 87775794
affiliation_lookup_by_hash 57748571
aggregation_service_helper_keys 49783589
aggregation_service_report 95942194
ambient_client 46775600
ambient_photo_cache 72532255
ambient_photo_controller 43026447
android_device_manager_socket 37249086
android_web_socket 39356976
@ericlaw1979
ericlaw1979 / ModifySetCookie.js
Created March 28, 2022 20:53
FiddlerScript to modify response Set-Cookie headers
// Add to OnPeekAtResponseHeaders function
if (oSession.HostnameIs("www.example.com")) {
for (var i=0; i<oSession.ResponseHeaders.Count(); i++) {
var thisHeader = oSession.oResponse.headers[i];
if (!StringExtensions.OICEquals(thisHeader.Name, "Set-Cookie")) continue;
if (StringExtensions.OICContains(thisHeader.Value, "SameParty")) continue;
thisHeader.Value = (thisHeader.Value + '; SameParty');
oSession["ui-backcolor"] = "yellow";
@ericlaw1979
ericlaw1979 / MakeItHTML.js
Created October 6, 2021 16:17
Transform XML+XSLT to plain html so that it loads without blocking (see https://textslashplain.com/2019/10/09/navigating-to-file-urls/ )
// Filenames
var sXML = "U_MS_Edge_V1R3_STIG_Manual-xccdf.xml";
var sXSLT = "STIG_unclass.xsl";
var sOutput = "TransformedHTML.html";
var fso, f, xmlstr, xsltstr;
fso = new ActiveXObject("Scripting.FileSystemObject");
f = fso.OpenTextFile(sXML);
@ericlaw1979
ericlaw1979 / CustomRules.js
Created September 28, 2021 18:34
Enable Fiddler to load NetLog files via command line directive
static function OnBoot() {
var s = Environment.GetCommandLineArgs();
for (var i=1; i<s.Length; i++){
if (s[i].StartsWith("-netlog:")){
// FiddlerObject.log("Command line told us to import Netlog " + s[i].Substring(8));
var oImportOptions = FiddlerObject.createDictionary();
oImportOptions.Add("Filename", s[i].Substring(8));
FiddlerApplication.DoImport("NetLog JSON", true, oImportOptions, null);
}
@ericlaw1979
ericlaw1979 / Get-ProcessHash.ps1
Last active October 12, 2021 22:40 — forked from pronichkin/Get-ProcessHash.ps1
Get a truncated SHA-1 hash for each running process name; use this to decipher edge://histograms/UIA process info
# Mostly written by https://gist.github.com/pronichkin/b1fcd7b797ed7194dce0a96d98765aa7
Get-Process | Sort-Object -Unique -Property 'Name' | Select-Object -Property @(
@{
'Label' = 'Name'
'Expression' = {
$psItem.Name + ".exe"
}
}
@ericlaw1979
ericlaw1979 / zipread.cs
Last active June 3, 2021 14:29
ZIP integrity checker
// https://stackoverflow.com/a/51860115/126229
// https://games.greggman.com/game/zip-rant/ -- Great article explaining why this format is kinda bad.
using System;
using System.IO;
using System.Text;
namespace ZipAnalysis
{
class Utilities {
public static string ByteArrayToHexView(byte[] inArr, int iStartAt, int iBytesPerLine, int iMaxByteCount, bool bShowASCII)
@ericlaw1979
ericlaw1979 / TypeTheClipboard.vbs
Created February 18, 2021 16:46
Types the contents of the clipboard to the focused text area three seconds after invocation (useful for using sites/apps that block CTRL+V paste). Useful as a script launched from [SlickRun](https://bayden.com/slickrun)
set WshShell = WScript.CreateObject("WScript.Shell")
WScript.Sleep 3000
'Hackery to get the clipboard's contents
Set objHTML = CreateObject("htmlfile")
text = objHTML.ParentWindow.ClipboardData.GetData("text")
WshShell.SendKeys text
@ericlaw1979
ericlaw1979 / ShowOriginalSessionID.js
Created December 1, 2020 19:00
Show the pre-save sessionID in a column for loaded Fiddler SAZ files
public BindUIColumn("OrigID", 50 /*width*/, 1 /*order*/, true/*sortNumerically*/)
static function ShowOriginalID(oS: Session): String {
return oS["x-OriginalSessionID"];
}