Skip to content

Instantly share code, notes, and snippets.

View kf0jvt's full-sized avatar

Kevin Thompson kf0jvt

View GitHub Profile
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
@kf0jvt
kf0jvt / git.md
Last active August 29, 2015 13:56
Git stuff I don't want to forget

fetch a remote branch

git checkout --track origin/daves_branch

Undo a commit from a few commits ago that was pushed up to github. Be warned that if you do this everyone will have to basically blow away their local copy of the repo and do a fresh git pull.

git rebase -i HEAD~4 
git push --force

That will show all the commits going back 4 and let you pick which ones you want to keep. A better way might be to delete the files, then you wont be rewriting history

@kf0jvt
kf0jvt / schema_update.py
Created February 12, 2014 21:01
Add a region code to veris - experimental
# Download https://raw2.github.com/lukes/ISO-3166-Countries-with-Regional-Codes/master/all/all.json
# and save as all.json in the same folder
import json
import os
from datetime import datetime
import uuid
# i = getIncident('blahblahblah.json')
def getIncident(inString):
return json.loads(open(inString).read())
{
"type": "text",
"from": {"data": "site"},
"properties": {
"enter": {
"text":"This is some text.",
"align": "center",
"baseline": "bottom",
"fill": {"value": "#000"}
}
#!/usr/bin/env python
import json
vDict=json.loads(open('verisc-enum.json').read())
def dict_walker(inCollection, pre=None):
pre = pre[:] if pre else []
#print(pre)
if isinstance(inCollection, dict):
@kf0jvt
kf0jvt / simple_bar.R
Last active August 29, 2015 13:56
Simple bar chart of vcdb data using Jay's veris package
library(verisr)
library(ggplot2)
# Load the data
vcdb.dir <- "../vcdb/data/json"
vcdb <- json2veris(vcdb.dir)
# Filter out the Unknowns
filt <- !getfilter(vcdb, list("action.hacking.variety"="Unknown"))
def aggregateIndustry(inArray):
returnArray = [{'_id':'31-33','friendly_name':'Manufacturing','count':0},
{'_id':'44-45','friendly_name':'Retail','count':0},
{'_id':'48-49','friendly_name':'Transportation','count':0}]
for eachIndustry in inArray:
if eachIndustry['_id'] in ['31','32','33']:
returnArray[0]['count'] += eachIndustry['count']
continue
if eachIndustry['_id'] in ['44','45']:
returnArray[1]['count'] += eachIndustry['count']
@kf0jvt
kf0jvt / dontforget.md
Created January 9, 2014 04:29
stuff I don't want to forget
@kf0jvt
kf0jvt / sample strings.txt
Last active January 2, 2016 01:39
just fucking around
http://www.utphysicians.com/21756/uthealth-informs-patients-incident-related-patient-information/ (20130830),http://healthitsecurity.com/2013/08/29/ut-physicians-informs-patients-of-data-breach/ (20130830)
https://oag.ca.gov/system/files/Final%20version%20of%20breach%20notification%20in%20PDF%20format%20%2800751822%29_0.PDF http://www.phiprivacy.net/burglar-snatches-laptop-with-patient-medical-records-from-san-jose-internists-office/
http://doj.nh.gov/consumer/security-breaches/documents/waste-management-20070403.pdf
@kf0jvt
kf0jvt / malware.md
Last active June 4, 2018 14:02
Recommended reading for malware analysis
  1. http://computer-forensics.sans.org/blog/2010/11/12/get-started-with-malware-analysis
  2. http://zeltser.com/malware-analysis-toolkit/
  3. http://zeltser.com/vmware-malware-analysis/
  4. http://computer-forensics.sans.org/blog/2010/10/11/3-phases-malware-analysis-behavioral-code-memory-forensics/
  5. BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection https://www.usenix.org/legacy/event/sec08/tech/full_papers/gu/gu.pdf
  6. Mining the Network Behavior of Bots http://isg.rhul.ac.uk/sullivan/pubs/tr/2009-12.pdf
  7. Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces https://www.usenix.org/legacy/event/nsdi10/tech/full_papers/perdisci.pdf
  8. From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final127.pdf
  9. Obfuscation of executable code to improve resistance to static disassembly http://www.cs.arizona.edu/~debray/Pub