Skip to content

Instantly share code, notes, and snippets.

View marcostolosa's full-sized avatar
👽
Mem3nt0 Mori.

Marco 'Tr0p' Tolosa marcostolosa

👽
Mem3nt0 Mori.
View GitHub Profile
@marcostolosa
marcostolosa / block_scanners.sh
Created November 20, 2025 15:03 — forked from s0ld13rr/block_scanners.sh
Script for Blocking Censys & Shodan IPs
#!/bin/bash
echo "[+] Installing scanners block rules with logging..."
LOGTAG="SCANNERS_BLOCK"
########################################
# Censys IPv4 ranges
########################################
CENSYS_V4=(
@marcostolosa
marcostolosa / NtMonitor.py
Created November 6, 2025 20:39 — forked from matterpreter/NtMonitor.py
Frida script to spawn a process and monitor Native API calls
import frida
import sys
def on_message(message, data):
if message['type'] == 'send':
print(message['payload'])
elif message['type'] == 'error':
print(message['stack'])
else:
print(message)
@marcostolosa
marcostolosa / patch.sh
Created November 6, 2025 16:41 — forked from jakeajames/patch.sh
Make h3lix work when installed not-via-Impactor. To be used with the latest h3lix.
if [ $# != 2 ]; then
echo "Usage: $0 /path/to/input_ipa /path/to/output_ipa"
exit 1
fi
if ! [ -f $1 ]; then
echo "'$1' does not exist"
exit 1
fi
@marcostolosa
marcostolosa / search-n-squeal.sh
Created October 18, 2025 09:22 — forked from scumdestroy/search-n-squeal.sh
Search'N'Squeal : Bash script that searches a list of dorks on Github and notifies if new search result has appeared
#!/bin/sh
# func to do the search w/ curl
# syntax `perform_search anti-fur_APIKEY gh_APIKEYAPIKEYAPIKEY`
perform_search() {
local search_term="$1"
local api_key="$2"
curl -s -H "Authorization: token $api_key" "https://api.github.com/search/repositories?q=$search_term" | jq '.items[].html_url'
}
WordPress: /wp-admin
Drupal: /admin
Joomla: /administrator
Magento: /admin
Concrete5: /dashboard
SilverStripe: /admin
Textpattern: /textpattern
MODX: /manager
Radiant CMS: /admin
Contao: /contao
#!/usr/bin/env python3
'''
Greetings bug-slaying brothers of the pythonian blood. This script takes my httpx output after slamming in a bunch of subdomains
and organizes it so its a bit easier to read and work with.
The HTTPX payload I use first is:
httpx -sc -cl -title -bp -server -td -ip -cname -asn -cdn -vhost -fhr | anew httpx-quicc
This script will organize the data by status code and then from smallest to largest for each status code
#!/usr/bin/env python3
'''
Get the excellent GoLinkFinder tool via github.com/0xsha/GoLinkFinder
... based on my boy here: https://github.com/GerbenJavado/LinkFinder
Anyways, this gives an excellent clean and parsed output after running GoLinkFinder on a gang of urls.
use this like:
python3 golinkfinderx.py urls.txt
'''

Screen Quick Reference

Basic

Description Command
Start a new session with session name screen -S <session_name>
List running sessions / screens screen -ls
Attach to a running session screen -x
Attach to a running session with name screen -r
// Saumyajeet Das
// Written/Compiled: Visual Studio 2022
// Usage: midiOutOpen.exe <shellcode file>
#pragma comment(lib, "winmm.lib")
#include <stdio.h>
#include <Windows.h>
#include <mmsystem.h>
BOOL ReadContents(PWSTR Filepath, PCHAR* Buffer, PDWORD BufferSize);
@marcostolosa
marcostolosa / JasonToddIsTheBestRobin.c
Created October 8, 2025 01:36 — forked from whokilleddb/JasonToddIsTheBestRobin.c
Unnecessarily complicated way of controlling shellcode execution using InternetStatusCallback()
#include <windows.h>
#include <wininet.h>
#include <stdio.h>
#pragma comment(lib, "wininet.lib")
// notepad.exe shellcode
char shellcode[] = {
0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51,
0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52,