kashifulhaque

Neovim keybinds

• Capital letters do the opposite of small letters in command (Press shift to trigger capital letters)
• _ (underscore) to move the cursor at the beginning of line (doesn't switch to insert mode)
  • 0 (zero) moves the cursor to the zeroth position of the line (doesn't switch to insert mode)
• $ (dollar) to move the cursor at the end of line (doesn't switch to insert mode)
• d$ will delete from wherever your cursor is till the end of the line
• f<character> to move cursor to the first occurrence of <character>
  • f( to move cursor to first occurence of (
• t<character> to move cursor to upto but not on the first occurrence of <character>
• t( to move cursor to first occurence of (

p4yl0ad

ldapsearch cheatsheet

SCCM

ldapsearch (objectClass=mSSMSManagementPoint) cn,name,dNSHostName,mSSMSSiteCode,mSSMSMPName 0 ""

Maybe these too, need to experiment

mSSMSSite
mSSMSServerLocatorPoint

D3Ext

AMSI Bypass

To perform all this techniques you can simply try them by typing "Invoke-Mimikatz" into your powershell terminal, you'll notice that even if you haven't imported Mimikatz it will detect that as malicious. But if the AMSI is off or you avoid it, it just will say that "it's not recognized as the name of a cmdlet", so you could say that you've bypassed the AMSI

However some methods may be detected by the AV but most of them actually work without problem

Powershell downgrade

The first and worst way to bypass AMSI is downgrading powershell version to 2.0.

pich4ya

// $ frida -l antiroot.js -U -f com.example.app --no-pause
// CHANGELOG by Pichaya Morimoto (p.morimoto@sth.sh): 
//  - I added extra whitelisted items to deal with the latest versions 
// 						of RootBeer/Cordova iRoot as of August 6, 2019
//  - The original one just fucked up (kill itself) if Magisk is installed lol
// Credit & Originally written by: https://codeshare.frida.re/@dzonerzy/fridantiroot/
// If this isn't working in the future, check console logs, rootbeer src, or libtool-checker.so
Java.perform(function() {

    var RootPackages = ["com.noshufou.android.su", "com.noshufou.android.su.elite", "eu.chainfire.supersu",

superkojiman

#!/usr/bin/env python3

'''
NameMash by superkojiman

Generate a list of possible usernames from a person's first and last name. 

https://blog.techorganic.com/2011/07/17/creating-a-user-name-list-for-brute-force-attacks/
'''