Skip to content

Instantly share code, notes, and snippets.

@fyxme
fyxme / ntlmdecoder.py
Last active November 2, 2022 11:33 — forked from aseering/ntlmdecoder.py
NTLM auth-string decoder
#!/usr/bin/env python
## On Microsoft RDWeb (Work resources - RemoteApp and Desktop Connection) Pages,
## You can force NTLM auth with the following command:
## > curl https://remote.vulnerable.com/RPC/ -H "Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==" -v
## Decodes NTLM "Authenticate" HTTP-Header blobs.
## Reads the raw blob from stdin; prints out the contained metadata.
## Supports (auto-detects) Type 1, Type 2, and Type 3 messages.
## Based on the excellent protocol description from:
@fyxme
fyxme / install-checkrain.sh
Last active September 22, 2022 00:29
Checkrain jailbreak install script
#!/bin/bash
# Script to install checkrain on Debian based distros
# From https://checkra.in/linux
# Easiet way to jailbreak, get a live usb Debian iso, install checkra1n and run checkra1n
wget -O - https://assets.checkra.in/debian/archive.key | gpg --dearmor | sudo tee /usr/share/keyrings/checkra1n.gpg >/dev/null
echo 'deb [signed-by=/usr/share/keyrings/checkra1n.gpg] https://assets.checkra.in/debian /' | sudo tee /etc/apt/sources.list.d/checkra1n.list
sudo apt-get update
@fyxme
fyxme / get_gists.py
Created April 8, 2022 02:20 — forked from leoloobeek/get_gists.py
Download all gists for a specific user
# first: mkdir user && cd user && cp /path/to/get_gists.py .
# python3 get_gists.py user
import requests
import sys
from subprocess import call
user = sys.argv[1]
r = requests.get('https://api.github.com/users/{0}/gists'.format(user))
@fyxme
fyxme / burp-target-scope-options.json
Last active May 29, 2024 13:17
Burp Target Scope Options file to exclude all irrelevant stuff
{
"target":{
"scope":{
"advanced_mode":true,
"exclude":[
{
"enabled":true,
"host":".*\\.google\\.com",
"protocol":"any"
},
@fyxme
fyxme / sqlmap-proxy.go
Last active October 10, 2024 16:07
Golang proxy example to abuse more complex SQL injections which may not be picked up by sqlmap. For example, SQL injections in CTF challenges
package main
/*
Golang proxy example to abuse more complex SQL injections which may not be picked up by sqlmap. For example, SQL injections in CTF challenges
*/
import (
"fmt"
@fyxme
fyxme / next_prime.py
Last active October 10, 2024 16:12
next_prime.py
#!/usr/bin/env python
import math
def isPrime(n):
""" Check if n is prime using trial division as our primality test """
if n%2 == 0 and n > 2:
# takes care of all the even numbers
return False
from random import random
from time import time
from multiprocessing import Pool
import matplotlib.pyplot as plt
def _avg(results):
return sum(results) / float(len(results))
def _range(results):