Find the culprit that prevents ejection of Flash Drives or any other unit.
wevtutil qe System /q:"*[System[(EventID=225)]]" /c:5 /f:text /rd:true
<# | |
Prerequisites: PowerShell v3+ | |
License: MIT | |
Author: Michael Klement <[email protected]> | |
DOWNLOAD and DEFINITION OF THE FUNCTION: | |
irm https://gist.github.com/mklement0/ef57aea441ea8bd43387a7d7edfc6c19/raw/Invoke-WithEncoding.ps1 | iex |
<# | |
Prerequisites: PowerShell v3+ | |
License: MIT | |
Author: Michael Klement <[email protected]> | |
DOWNLOAD and DEFINITION OF THE FUNCTION: | |
irm https://gist.github.com/mklement0/eac1f18fbe0fc2798b214229b747e5dd/raw/Debug-NativeInOutput.ps1 | iex |
##TCP FLAGS## | |
Unskilled Attackers Pester Real Security Folks | |
============================================== | |
TCPDUMP FLAGS | |
Unskilled = URG = (Not Displayed in Flag Field, Displayed elsewhere) | |
Attackers = ACK = (Not Displayed in Flag Field, Displayed elsewhere) | |
Pester = PSH = [P] (Push Data) | |
Real = RST = [R] (Reset Connection) | |
Security = SYN = [S] (Start Connection) |
NB: This will not work for instances that proxy outgoing requests!
I wanted to find a way to detect the real IP address of a Mastodon/Pleroma/Misskey/etc instance hosted behind Cloudflare. How to do that? Well, it's federated, which means I can probably get it to send a request to a server of mine! And how to do that? I tried reading the ActivityPub spec. The following caught my attention:
Servers should not trust client submitted content, and federated servers also should not trust content received from a server other than the content's origin without some form of verification.
<# | |
Prerequisites: PowerShell v5.1 and above (verified; may also work in earlier versions) | |
License: MIT | |
Author: Michael Klement <[email protected]> | |
DOWNLOAD and DEFINITION OF THE FUNCTION: | |
irm https://gist.github.com/mklement0/7f2f1e13ac9c2afaf0a0906d08b392d1/raw/Debug-String.ps1 | iex |
<# | |
Prerequisites: PowerShell version 2 or above. | |
License: MIT | |
Author: Michael Klement <[email protected]> | |
DOWNLOAD, from PowerShell version 3 or above: | |
irm https://gist.github.com/mklement0/243ea8297e7db0e1c03a67ce4b1e765d/raw/Out-HostColored.ps1 | iex |
package main | |
import ( | |
"io/ioutil" | |
"log" | |
"strings" | |
) | |
func main() { | |
input, err := ioutil.ReadFile("myfile") |
# List privileged services that don't come with Windows 10 | |
# Exclusion List for Win10 built in | |
$exclusion = @('AppVClient', 'ClickToRunSvc', 'COMSysApp', 'diagnosticshub.standardcollector.service', | |
'msiserver', 'ose', 'perceptionsimulation', 'SecurityHealthService', 'Sense', | |
'SensorDataService', 'SgrmBroker', 'Spooler', 'ssh-agent', 'TieringEngineService', | |
'TrustedInstaller', 'UevAgentService', 'vds', 'VSS', 'wbengine', 'WinDefend', 'wmiApSrv', | |
'WSearch', 'SamSs') | |
# Get Service List with LocalSystem and Startmode Auto and does not contain svchost.exe (Also exclude the ones from the list) |
<# | |
Prerequisites: PowerShell v3+ | |
License: MIT | |
Author: Michael Klement <[email protected]> | |
DOWNLOAD and DEFINITION OF THE FUNCTION: | |
irm https://gist.github.com/mklement0/25694cbb8e10a7044b36a310e1243959/raw/Get-CharInfo.ps1 | iex |