J. O. Makar jo-makar

SQL injection notes / tools

userpass.py

Assume a login page with the query: select password from admins where username=\'%s\'

Login outright use:

username: ' union select "foo"; --
password: foo

Setup a PXE boot server

Using dnsmasq (on Debian)

apt-get install dnsmasq pxelinux syslinux-common syslinux-efi

mkdir /srv/tftpboot

ln -s /usr/lib/PXELINUX/pxelinux.0 /srv/tftpboot/

Read live process memory

/proc/$pid/maps describes virtual memory regions with the first column being the address range

cd /proc/$pid/mem

# Extract the start and end address for the first entry (NR==1)
eval $(awk -F'[- ]' 'NR==1 {print "s="$1" e="$2}' maps)

Create the modified ISO

mount -o loop debian-10.0.0-amd64-netinst.iso /mnt/loop
mkdir debian-10.0.0-amd64-netinst
shopt -s dotglob; cp -rv /mnt/loop/* debian-10.0.0-amd64-netinst/
umount /mnt/loop

dd if=debian-10.0.0-amd64-netinst.iso of=isohdpfx.bin bs=1 count=432

cp debian-10.0.0-amd64-netinst/.disk/mkisofs .

Systray notifier

This is a simple project to receive D-Bus desktop notifications and display them with a systray application.

Purposefully displaying notifications only when the systray application is right-clicked, if OSD notifications is your preference there are a multitude of options available: notification-daemon, notify-osd, dunst, etc.

	import collections, datetime, threading, time


	class MetricsThread(threading.Thread):
	'''
	Thread-safe metrics storage that calculates rate of change using linear regression (ie line-fitting).
	Values can be stored by (external) increment calls and/or by periodic callback functions.

	Keyword arguments:
	callbacks -- metrics to be also determined periodically via callbacks,

	# Suricata rule lexer/parser
	#
	# http://www.dabeaz.com/ply/ply.html
	# https://suricata.readthedocs.io/en/latest/rules/intro.html
	#
	# TODO Perhaps a better approach is to isolate the signature parsing code from the suricata source
	# and create bindings for higher-level languages around that isolated code
	# See https://github.com/OISF/suricata/tree/master/src/detect-parse.{c,h} SigParse()

	#include "logstream.hpp"

	#include <chrono>
	#include <ctime>
	#include <mutex>
	#include <thread>
	using namespace std;

	unsigned int thread_id() {
	static unsigned int idx = 0;

	#!/usr/bin/env python3
	# Restore/build an i3 session

	import argparse, json, logging, queue, subprocess, threading

	if __name__ == '__main__':
	def i3msg(args):
	cmd = ['i3-msg'] + args
	logging.info('cmd = %r', cmd)
	subprocess.check_call(cmd, stderr=subprocess.STDOUT, encoding='utf-8')

	package logger

	import (
	"fmt"
	"io"
	"path"
	"runtime"
	"strings"
	"sync"
	"time"