queencitycyber

#!/usr/bin/env python3

#Purpose: To check for and reveal AD user accounts that share passwords using a hashdump from a Domain Controller
#Script requires a command line argument of a file containing usernames/hashes in the format of user:sid:LMHASH:NTLMHASH:::
# ./check_hashes.py <hash_dump>

import argparse
import re

parser = argparse.ArgumentParser(description="Check user hashes against each other to find users that share passwords")

queencitycyber

"""
A tiny Flask web server ready to shoot reflective CORS Access-Control-Allow-Origin headers to accept connections from an XSS affected victim while hosting your evil JS payload
"""
# Stolen from https://twitter.com/snovvcrash/status/1511702029403631620

from flask import Flask, send_file
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

queencitycyber

###
# Dumps GitLab's user base to CSV form.
# Source: https://www.rapid7.com/blog/post/2022/03/03/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed/
# Requires GraphqlClient: pip install python-graphql-client
###
from python_graphql_client import GraphqlClient
import json
import sys
import argparse

queencitycyber

Tired of having random notes and shit floatin around. Most of this will probably exist elsewhere in my notes, but I'd like to have it here to remember

# Console Table. Update as needed
`console.table([...document.querySelectorAll('.fatitem table .athing')].map(el => [el.textContent.trim(), el.nextSibling.textContent.trim()]).sort(([,a], [,b]) => parseInt(b) - parseInt(a)))`

# No clue. From Outlook headers
https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://Foutlook.office.com&shsid=[GUID]&apiver=oneshell&cshver=20220227.1&upn=[REDACTED]

queencitycyber

Mostly older shit from '17-'20. Some good, some stale. Posting here for posterity. 

Pulled from my private Workflowy repo.

======================================

hackery (@Section31D)

- Penetration Testing/Assessment Workflow

queencitycyber

Good detailed info on running solid CTF: https://github.com/pwning/docs/blob/master/suggestions-for-running-a-ctf.markdown
General Notes:

	- Announce on ctftime.org
	- Make flag easy!
		"Flag=somsomething"
		- Make flag very permissible (insensitive, accept multiple features, etc)
	- Deliver files via HTTP