Skip to content

Instantly share code, notes, and snippets.

View ericlaw1979's full-sized avatar
💭
Working on Microsoft Web Defense

Eric Lawrence ericlaw1979

💭
Working on Microsoft Web Defense
185 followers · 7 following
View GitHub Profile
@ericlaw1979
ericlaw1979 / traffic annotation values
Created May 11, 2022 18:23
See https://chromium-review.googlesource.com/c/chromium/src/+/3639562 and https://textslashplain.com/2020/04/08/analyzing-network-traffic-logs-netlog-json/
accounts_image_fetcher 98658519
adb_client_socket 87775794
affiliation_lookup_by_hash 57748571
aggregation_service_helper_keys 49783589
aggregation_service_report 95942194
ambient_client 46775600
ambient_photo_cache 72532255
ambient_photo_controller 43026447
android_device_manager_socket 37249086
android_web_socket 39356976
@ericlaw1979
ericlaw1979 / ModifySetCookie.js
Created March 28, 2022 20:53
FiddlerScript to modify response Set-Cookie headers
// Add to OnPeekAtResponseHeaders function
if (oSession.HostnameIs("www.example.com")) {
for (var i=0; i<oSession.ResponseHeaders.Count(); i++) {
var thisHeader = oSession.oResponse.headers[i];
if (!StringExtensions.OICEquals(thisHeader.Name, "Set-Cookie")) continue;
if (StringExtensions.OICContains(thisHeader.Value, "SameParty")) continue;
thisHeader.Value = (thisHeader.Value + '; SameParty');
oSession["ui-backcolor"] = "yellow";
@ericlaw1979
ericlaw1979 / MakeItHTML.js
Created October 6, 2021 16:17
Transform XML+XSLT to plain html so that it loads without blocking (see https://textslashplain.com/2019/10/09/navigating-to-file-urls/ )
// Filenames
var sXML = "U_MS_Edge_V1R3_STIG_Manual-xccdf.xml";
var sXSLT = "STIG_unclass.xsl";
var sOutput = "TransformedHTML.html";
var fso, f, xmlstr, xsltstr;
fso = new ActiveXObject("Scripting.FileSystemObject");
f = fso.OpenTextFile(sXML);
@ericlaw1979
ericlaw1979 / CustomRules.js
Created September 28, 2021 18:34
Enable Fiddler to load NetLog files via command line directive
static function OnBoot() {
var s = Environment.GetCommandLineArgs();
for (var i=1; i<s.Length; i++){
if (s[i].StartsWith("-netlog:")){
// FiddlerObject.log("Command line told us to import Netlog " + s[i].Substring(8));
var oImportOptions = FiddlerObject.createDictionary();
oImportOptions.Add("Filename", s[i].Substring(8));
FiddlerApplication.DoImport("NetLog JSON", true, oImportOptions, null);
}
@ericlaw1979
ericlaw1979 / Get-ProcessHash.ps1
Last active October 12, 2021 22:40 — forked from pronichkin/Get-ProcessHash.ps1
Get a truncated SHA-1 hash for each running process name; use this to decipher edge://histograms/UIA process info
# Mostly written by https://gist.github.com/pronichkin/b1fcd7b797ed7194dce0a96d98765aa7
Get-Process | Sort-Object -Unique -Property 'Name' | Select-Object -Property @(
@{
'Label' = 'Name'
'Expression' = {
$psItem.Name + ".exe"
}
}
@ericlaw1979
ericlaw1979 / zipread.cs
Last active June 3, 2021 14:29
ZIP integrity checker
// https://stackoverflow.com/a/51860115/126229
// https://games.greggman.com/game/zip-rant/ -- Great article explaining why this format is kinda bad.
using System;
using System.IO;
using System.Text;
namespace ZipAnalysis
{
class Utilities {
public static string ByteArrayToHexView(byte[] inArr, int iStartAt, int iBytesPerLine, int iMaxByteCount, bool bShowASCII)
@ericlaw1979
ericlaw1979 / TypeTheClipboard.vbs
Created February 18, 2021 16:46
Types the contents of the clipboard to the focused text area three seconds after invocation (useful for using sites/apps that block CTRL+V paste). Useful as a script launched from [SlickRun](https://bayden.com/slickrun)
set WshShell = WScript.CreateObject("WScript.Shell")
WScript.Sleep 3000
'Hackery to get the clipboard's contents
Set objHTML = CreateObject("htmlfile")
text = objHTML.ParentWindow.ClipboardData.GetData("text")
WshShell.SendKeys text
@ericlaw1979
ericlaw1979 / ShowOriginalSessionID.js
Created December 1, 2020 19:00
Show the pre-save sessionID in a column for loaded Fiddler SAZ files
public BindUIColumn("OrigID", 50 /*width*/, 1 /*order*/, true/*sortNumerically*/)
static function ShowOriginalID(oS: Session): String {
return oS["x-OriginalSessionID"];
}
@ericlaw1979
ericlaw1979 / gist:0daa972269eb4c2efacf068c06173a10
Created December 1, 2020 18:51
Show Low-level read timings
// https://groups.google.com/d/msg/httpfiddler/BNnW_Y9jxCQ/eIaQsKhInPoJ
// https://microsite.omniture.com/t2/help/en_US/sc/implement/index.html#Sample_Product_Strings
public BindUITab("ReadTiming", true)
static function readsReport(arrSess: Session[]):String {
var oSB: System.Text.StringBuilder = new System.Text.StringBuilder();
oSB.Append("<html><head></head><body>");
for (var i:int = 0; i<arrSess.Length; i++)
{
var sClt:String = arrSess[i].Timers.ClientReads.ToString();
var sSrv:String = arrSess[i].Timers.ServerReads.ToString();
@ericlaw1979
ericlaw1979 / META CACHING Directives.ms
Created March 2, 2020 20:07
MeddlerScript test case. Only IE and Edge 18 and below support META cache-control and META pragma https://crbug.com/2763 https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives
/*
Only IE and Edge 18 and below support META cache-control and META pragma
https://crbug.com/2763
https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives
*/
import Meddler;
import System;
import System.Net.Sockets;
import System.Windows.Forms;