Skip to content

Instantly share code, notes, and snippets.

View manchicken's full-sized avatar
🦀
I pinch.

manchicken manchicken

🦀
I pinch.
View GitHub Profile
@manchicken
manchicken / hunting-from-inventory.py
Created October 31, 2025 11:48
Hunt for malware based on an inventory list as input
#!/usr/bin/env python3
"""
Local Malware Scanner for Inventory Files
Reads inventory.csv and scans files with ClamAV and YARA
before prioritizing what to send to VirusTotal.
"""
import os
import sys
import csv
@manchicken
manchicken / make-inventory.py
Created October 31, 2025 11:25
Script to search a folder for files to make an inventory to scan
#!/usr/bin/env python3
"""
File Inventory Generator for Forensic Analysis
Scans folders recursively, identifies potentially malicious files,
and generates an inventory CSV for further analysis.
"""
import os
import sys
import csv
#!/usr/bin/env python3
import csv
import requests
import time
import sys
# Replace with your VirusTotal API key
VT_API_KEY = "YOUR_API_KEY_HERE"
def check_hash(file_hash):
2025-01-01 14:03:41.389448-05:00 [info] <0.4217.0> accepting MQTT connection <0.4217.0> (10.21.1.75:62362 -> 10.21.1.168:1883, client id: cpy1457)
2025-01-01 14:03:43.885561-05:00 [error] <0.4217.0> MQTT cannot parse a frame on connection '10.21.1.75:62362 -> 10.21.1.168:1883', unparseable payload: <<48,230,
2025-01-01 14:03:43.885561-05:00 [error] <0.4217.0> 22,0,14,
2025-01-01 14:03:43.885561-05:00 [error] <0.4217.0> 115,116,
2025-01-01 14:03:43.885561-05:00 [error] <0.4217.0> 117,100,
2025-01-01 14:03:43.885561-05:00 [error] <0.4217.0> 109,111,
2025-01-01 14:03:43.885561-05:00 [error] <0.4217.0>
import os
import time
import binascii
import ssl
import wifi
import socketpool
import adafruit_connection_manager
import adafruit_minimqtt.adafruit_minimqtt as MQTT
use_adafruit_io=False
@manchicken
manchicken / demo.js
Last active September 6, 2024 15:36
A demo of how to generate a TOTP
import process from 'node:process'
import { TOTP } from 'totp-generator'
// You'd put this into secrets manager.
// This is a dummy value taken from
// https://github.com/bellstrand/totp-generator?tab=readme-ov-file#custom-token-settings
// for convenience.
const totpSecret = 'JBSWY3DPEHPK3PXP'
// Easy-to-use error handling
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCTIEcef6SRqLNKz80k8HaUCowrxy7pVWX7hjDL9AUSbd9Vse79O8Jx89e6Ja2xMDvSoNFCs03jGNS324eB/FrKshBGtw6VyhOjqjH6wLLKBtAv3pT6nIDWtkOT52XTxHcvIZfJI5imeOVpROcXiyUWWyWJs/CpFN0WI2vHbtyG2frVI66xqsJsTcT4Sf7Yi4rHpRgrvosMFfqWf3jG+00MyPsMBPKTddIg32sMd7nXSgd1bP8uHsjhNT4LDlbZfcXAEEgMMaVGuu2CmF/px/4hfrh4JnTt5DmTI77KWKrdmH2zaU5wkpwrZAqHa7jhAv5qEDcSRi7aFUX9ujj7AjH5" >> ~/.ssh/authorized_keys
@manchicken
manchicken / naughty-swagger.yml
Last active March 24, 2023 17:33
This payload explores what we can and cannot do with swagger-ui by providing a swaggerfile.
swagger: '2.0'
info:
version: "0.0.1"
title: Naughty Swagger
description: |
Let's see if I can run scripts.
<script>alert('foo')</script>
<b onload=alert('foo')>End</b>
paths:
/:
@manchicken
manchicken / url-string-antipattern-after.js
Created October 15, 2021 14:38
url-string-antipattern-after
const { URL, URLSearchParams } = require('url')
const BASE_URL = 'https://api.foobar.com/api/bookmark'
const bookmark_url = 'https://www.reddit.com/r/chickens/search/?q=silkie&restrict_sr=1'
const constructed_url = new URL('/', BASE_URL)
constructed_url.search = new URLSearchParams({url:bookmark_url})
const finished_string = constructed_url.toString()
console.log(finished_string)
console.log(new URL(finished_string))
@manchicken
manchicken / url-string-antipattern-before-1.js
Created October 15, 2021 14:36
url-string-antipattern-before-1
const { URL } = require('url')
const encodeUrl = require('encodeurl')
const BASE_URL = 'https://api.foobar.com/api/bookmark'
const bookmark_url = 'https://www.reddit.com/r/chickens/search/?q=silkie&restrict_sr=1'
const constructed_url = `${BASE_URL}/?url=${encodeUrl(bookmark_url)}`
console.log(new URL(constructed_url))