Skip to content

Instantly share code, notes, and snippets.

View jedisct1's full-sized avatar

Frank Denis jedisct1

View GitHub Profile
@kennwhite
kennwhite / vpn_psk_bingo.md
Last active June 6, 2025 20:44
Most VPN Services are Terrible

Most VPN Services are Terrible

Short version: I strongly do not recommend using any of these providers. You are, of course, free to use whatever you like. My TL;DR advice: Roll your own and use Algo or Streisand. For messaging & voice, use Signal. For increased anonymity, use Tor for desktop (though recognize that doing so may actually put you at greater risk), and Onion Browser for mobile.

This mini-rant came on the heels of an interesting twitter discussion: https://twitter.com/kennwhite/status/591074055018582016

@jedisct1
jedisct1 / dyre-dga.py
Last active August 29, 2015 14:18
Dyre/Dyreza DGA
#! /usr/bin/env python
# Dyre/Dyreza DGA
# Implementation by Talos
# From http://blogs.cisco.com/security/talos/threat-spotlight-dyre
# Another Python implementation was also posted back in December 2014 by moritz.kroll:
# https://www.virustotal.com/en/file/3716902c64afe40369e6ed67f9b9f7eea30f809348b3558adcff622965e80435/analysis/
from datetime import date
from hashlib import sha256
from socket import gethostbyname, gaierror
@baderj
baderj / dga.py
Last active January 12, 2016 13:02
"""
generate domains according to:
- https://www.endgame.com/blog/malware-with-a-personal-touch.html
- http://www.rsaconference.com/writable/presentations/file_upload/br-r01-end-to-end-analysis-of-a-domain-generating-algorithm-malware-family.pdf
requires words1.txt and words2.txt
"""
import time
from datetime import datetime
import argparse
#!/bin/sh
remove_dangling() {
echo "Removing dangling images ..."
docker rmi $(docker images -f dangling=true -q)
}
remove_stopped_containers() {
echo "Removing stopped containers ..."
docker rm $(docker ps -qa)
@kmcallister
kmcallister / MOVED.md
Last active August 29, 2015 14:07
151-byte static binary for x86-64 Linux, all code in Rust
@jedisct1
jedisct1 / pureftpd shellshock.txt
Last active August 8, 2023 20:07
Pure-FTPd + external authentication handler #shellshock POC
$ cat > /tmp/handler.sh
#! /bin/bash
echo auth_ok:1
echo uid:42
echo gid:21
echo dir:/tmp
echo end
^D
$ chmod +x /tmp/handler.sh
#!/bin/sh
remove_dangling() {
echo "Removing dangling images ..."
docker rmi $(docker images -f dangling=true -q)
}
remove_stopped_containers() {
echo "Removing stopped containers ..."
docker rm $(docker ps -qa)
@lukaszraczylo
lukaszraczylo / delete-hipchat-history.rb
Last active July 13, 2021 15:43
Delete hipchat 1:1 history (WORKING)
#!/usr/bin/env ruby
# To make it work:
# - change account details to yours ( obviously ;) )
# - install mechanize gem in version 1.0.0 ( gem install mechanize -v '1.0.0' )
# - look for !!HERE!! comments in code in case you'd like to change default behavior
# - for best results run this script few times as hipchat / ruby openssl don't play together that well and
# there might be an exception thrown from time to time. Script should retry then but hey.. Nobody is perfect.
# .. and finally. Remember that other part should run this script as well to make history clean.
@sh1n0b1
sh1n0b1 / ssltest.py
Created April 8, 2014 07:53
Python Heartbleed (CVE-2014-0160) Proof of Concept
#!/usr/bin/python
# Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford ([email protected])
# The author disclaims copyright to this source code.
import sys
import struct
import socket
import time
import select
@jedisct1
jedisct1 / nuclear-ek-gen.txt
Created February 23, 2014 08:43
Nuclear Exploit Kit DGA prediction
This file has been truncated, but you can view the full file.
accelerateaccountant.in.net
accelerateactor.in.net
accelerateactress.in.net
accelerateactuary.in.net
accelerateadvisor.in.net
accelerateaide.in.net
accelerateambassador.in.net
accelerateanimator.in.net
acceleratearcher.in.net
acceleratearchery.in.net