Skip to content

Instantly share code, notes, and snippets.

View kyhwana's full-sized avatar

Kyhwana Pardus kyhwana

View GitHub Profile

Keybase proof

I hereby claim:

  • I am kyhwana on github.
  • I am kyhwana (https://keybase.io/kyhwana) on keybase.
  • I have a public key whose fingerprint is B30C 8C4B A734 513F FC75 41C7 B561 9CE0 3A15 5B13

To claim this, I am signing this object:

inotifywait -m /opt/dionaea/var/dionaea/binaries/ -e create |
while read path action file; do
if [[ "$file" != *"smb"* ]]; then
if [[ "$file" != *"httpupload"* ]]; then
date=`date`
echo "The file '$file' appeared in directory '$path' via '$action' at '$date'"
firejail --quiet yara -w /opt/dionaea/rules-master/malware_index.yar $path$file
firejail --quiet clamscan $path$file --no-summary
fi
fi
@kyhwana
kyhwana / gist:0002cc64e8938e142e82b807e55e0b60
Created October 22, 2017 04:12
Password manager audits.
Lastpass: All under NDAs. https://lastpass.com/support.php?cmd=showfaq&id=1626
1password: https://support.1password.com/security-assessments/
keepass: https://www.ghacks.net/2016/11/22/keepass-audit-no-critical-security-vulnerabilities-found/
enpass: none.
pass: none?
This gist will set ALL (except blook rebooting in safemode) the attack surface reduction (ASR) rules as per https://learn.microsoft.com/en-us/defender-endpoint/enable-attack-surface-reduction
Set-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,d4f940ab-401b-4efc-aadc-ad5f3c50688a,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,01443614-cd74-433a-b99e-2ecdc07bfc25,5beb7efe-fd9a-4556-801d-275e5ffc04cc,d3e037e1-3eb8-44c8-a917-57927947596d,3b576869-a4ec-4529-8536-b80a7769e899,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,26190899-1602-49e8-8b27-eb1d0a1ce869,e6db77e5-3df2-4cf1-b95a-636979351e5b,d1e49aac-8f56-4280-b9ba-993a6d77406c,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb,a8f5898e-1dc8-49a9-9878-85004b8a61e6,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,c1db55ab-c21a-4637-bb3f-a12568109d35, 33ddedf1-c6e0-47cb-833e-de6133960387 -AttackSurfaceReductionRules_Actions Enabled, Enabled, Enabled, Enabled, Enabl
@kyhwana
kyhwana / sslhdebianapparmorprofile
Created January 16, 2018 03:27
sslh apparmor profile for debian 9
# Last Modified: Tue Jan 16 16:27:04 2018
#include <tunables/global>
/usr/sbin/sslh {
#include <abstractions/base>
#include <abstractions/dovecot-common>
#include <abstractions/nameservice>
#include <abstractions/nis>
#include <abstractions/postfix-common>
@kyhwana
kyhwana / gist:bd80e180ca7c9245e32aa45cfe5620d6
Created January 23, 2018 23:52
Authy 2.5.0_0 diff to show TOTP account secrets.
19316,19317d19315
< }, d.prototype.getSharedSecret = function() {
< return this.isEncrypted() ? "?" : this.decryptedSeed
26333,26337d26330
< }), f(".copysecret").click(function (t) {
< var n, r, o;
< return n = f(this), o = function () {
< return n.text("Copy Secret")
< }, r = n.parent().find(".sharedSecret")[0], e.onCopyClicked(r), n.text("Copied secret"), setTimeout(o, 1e3)
26378,26380c26371
@kyhwana
kyhwana / gist:bdbbc35532d264143dcbe00e07b2c461
Created January 23, 2018 23:52
Authy 2.5.0_0 diff to show TOTP account secrets.
19316,19317d19315
< }, d.prototype.getSharedSecret = function() {
< return this.isEncrypted() ? "?" : this.decryptedSeed
26333,26337d26330
< }), f(".copysecret").click(function (t) {
< var n, r, o;
< return n = f(this), o = function () {
< return n.text("Copy Secret")
< }, r = n.parent().find(".sharedSecret")[0], e.onCopyClicked(r), n.text("Copied secret"), setTimeout(o, 1e3)
26378,26380c26371
@kyhwana
kyhwana / usr.bin.steam
Created February 12, 2018 21:43
steam ubuntu apparmor
# Last Modified: Sat Feb 10 17:50:50 2018
#include <tunables/global>
/usr/bin/steam {
#include <abstractions/X>
#include <abstractions/base>
#include <abstractions/bash>
#include <abstractions/lightdm>
#include <abstractions/nameservice>
@kyhwana
kyhwana / home.roughtime.server
Created September 22, 2018 01:50
Apparmor profile for roughenough server
#include <tunables/global>
/home/roughtime/server {
#include <abstractions/base>
/home/roughtime/roughenough.cfg r,
/home/roughtime/server mr,
}
@kyhwana
kyhwana / listofroughtimeservers.txt
Last active December 16, 2021 05:00
List of roughtime servers
roughtime.int08h.com port:2002 016e6e0284d24c37c6e4d7d8d5b4e1d3c1949ceaa545bf875616c9dce0c9bec1
roughtime.kyhwana.org port:2002 f1992a67a9d14b662efa86cca3db62cfc2e48810cf45ba5df181d8fc135b8261
roughtime.blackhatspottycat.net:2002 2397e2512392ad9532341b0dbc3581a3a04dabffebf00bd0af8d6deac19071bc
roughtime.sandbox.google.com:2002 etPaaIxcBMY1oUeGpwvPMCJMwlRVNxv51KK/tktoJTQ= / 7ad3da688c5c04c635a14786a70bcf30224cc25455371bf9d4a2bfb64b682534
roughtime.cloudflare.com:2002 gD63hSj3ScS+wuOeGrubXlq35N1c5Lby/S+T7MNTjxo= / 803eb78528f749c4bec2e39e1abb9b5e5ab7e4dd5ce4b6f2fd2f93ecc3538f1a