Skip to content

Instantly share code, notes, and snippets.

@itsmenaga
itsmenaga / log4j_rce_check.py
Created December 13, 2021 04:46 — forked from byt3bl33d3r/log4j_rce_check.py
Python script to detect if an HTTP server is potentially vulnerable to the log4j 0day RCE (https://www.lunasec.io/docs/blog/log4j-zero-day/)
#! /usr/bin/env python3
'''
Needs Requests (pip3 install requests)
Author: Marcello Salvati, Twitter: @byt3bl33d3r
License: DWTFUWANTWTL (Do What Ever the Fuck You Want With This License)
This should allow you to detect if something is potentially exploitable to the log4j 0day dropped on December 9th 2021.
# Quickly allow filtering of the available updates by using the Out-GridView cmdlet
Import-Csv -Path 'C:\computers.txt' | Get-WindowsUpdate | Out-GridView
# Export the Results of Windows Update to a CSV File
Import-Csv -Path 'C:\computers.txt' | Get-WindowsUpdate | Export-CSV -Path '.\WindowsUpdate.csv' -NoTypeInformation -Force
Import-Csv -Path '.\WindowsUpdate.csv'
Function Out-WindowsUpdateReport {
<#
@itsmenaga
itsmenaga / slackpost.sh
Created May 29, 2021 15:39 — forked from elnygren/slackpost.sh
Post to Slack webhook with curl & jq
#!/usr/bin/env bash
# CONFIG
URL="https://hooks.slack.com/services/..."
PAYLOAD='{
"channel": "#test",
"username": "Ghost",
"text": "no-message",
"icon_emoji": ":ghost:"
}'
@itsmenaga
itsmenaga / PoC_CVE-2021-28482.py
Created May 3, 2021 07:52 — forked from testanull/PoC_CVE-2021-28482.py
PoC of CVE-2021-28482
import requests
import time
import sys
from base64 import b64encode
from requests_ntlm2 import HttpNtlmAuth
from urllib3.exceptions import InsecureRequestWarning
from urllib import quote_plus
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
@itsmenaga
itsmenaga / shodan_api_query.py
Created July 4, 2020 13:39 — forked from LuD1161/shodan_api_query.py
Query Shodan API : Plain and Simple
# -*- coding: utf-8 -*-
import requests
import time
import os
import json
import sys
headers = {
'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100101 Firefox/77.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
#!/bin/bash
touch index.html
touch error.html
aws s3api create-bucket --bucket $1 --region us-east-1
aws s3 website s3://$1/ --index-document index.html --error-document error.html
aws s3 cp index.html s3://$1 --acl public-read
aws s3 cp error.html s3://$1 --acl public-read
@itsmenaga
itsmenaga / user.js
Created May 15, 2020 15:22 — forked from AetherEternity/user.js
Silent firefox
// Mozilla User Preferences
// To change a preference value, you can either:
// - modify it via the UI (e.g. via about:config in the browser); or
// - set it within a user.js file in your profile (create it if it doesn't exist).
//
// Profile folder location on different systems:
// Windows: C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default
// Mac OS X: Users/<username>/Library/Application Support/Firefox/Profiles/xxxxxxxx.default
// Linux: /home/<username>/.mozilla/firefox/xxxxxxxx.default
@itsmenaga
itsmenaga / dicom-bruteforce.py
Created April 29, 2020 18:11 — forked from ianatha/dicom-bruteforce.py
DEFCON 27 BHV CTF
#/usr/bin/env python3
# run me with ulimits -n 2048
import itertools
import string
from pydicom.dataset import Dataset
from pynetdicom import AE, QueryRetrievePresentationContexts
from pynetdicom.sop_class import PatientRootQueryRetrieveInformationModelFind
import sys
import time
@itsmenaga
itsmenaga / ejs.sh
Created April 17, 2020 20:20 — forked from gwen001/ejs.sh
onliner to extract endpoints from JS files of a given host
curl -L -k -s https://www.example.com | tac | sed "s#\\\/#\/#g" | egrep -o "src['\"]?\s*[=:]\s*['\"]?[^'\"]+.js[^'\"> ]*" | awk -F '//' '{if(length($2))print "https://"$2}' | sort -fu | xargs -I '%' sh -c "curl -k -s \"%\" | sed \"s/[;}\)>]/\n/g\" | grep -Po \"(\>\>\>)|(['\\\"](https?:)?[/]{1,2}[^'\\\"]{5,})|(\.(get|post|ajax|load)\s*\(\s*['\\\"](https?:)?[/]{1,2}[^'\\\"]{5,})\"" | awk -F "['\"]" '{print $2}' | sort -fu
function ejs() {
curl -L -k -s "$1" | tac | sed "s#\\\/#\/#g" | egrep -o "src['\"]?\s*[=:]\s*['\"]?[^'\"]+.js[^'\"> ]*" | awk -F '//' '{if(length($2))print "https://"$2}' | sort -fu | xargs -I '%' sh -c "curl -k -s \"%\" | sed \"s/[;}\)>]/\n/g\" | grep -Po \"(['\\\"](https?:)?[/]{1,2}[^'\\\"]{5,})|(\.(get|post|ajax|load)\s*\(\s*['\\\"](https?:)?[/]{1,2}[^'\\\"]{5,})\"" | awk -F "['\"]" '{print $2}' | sort -fu
}
@itsmenaga
itsmenaga / openinbrowser.py
Created May 19, 2019 05:46 — forked from hakluke/openinbrowser.py
Little Python script to open a list of URLs from a file in browser tabs, n tabs at a time
#! /usr/bin/python3
import webbrowser, sys
if len(sys.argv) < 3:
print("Usage: openinbrowser.py ./urls.txt 20")
quit()
f = open(sys.argv[1])
tabs = int(sys.argv[2])
counter = 1