Skip to content

Instantly share code, notes, and snippets.

View spookerlabs's full-sized avatar

Rodrigo Montoro spookerlabs

15 followers · 1 following
View GitHub Profile
@spookerlabs
spookerlabs / bsides-workshop-2022
Last active August 9, 2022 22:43
bsides-workshop-labs
Material for AWS Least Privilege Workshop Bsides 2022
bsidesLV2022 - Preparing machine before class
https://www.evernote.com/shard/s320/sh/11d1d550-ef02-0a35-d918-f5a8c3929b2a/f9771c476dbcda85942fae426dc65987
bsidesLV2022 - Lab one - Configure and Playing with Cloudsplaining
https://www.evernote.com/shard/s320/client/snv?noteGuid=5987d975-2f1f-3974-5aa9-4305b3d46f9d&noteKey=cbee06a12dd1268ce6b7d72fa9112ba8&sn=https%3A%2F%2Fwww.evernote.com%2Fshard%2Fs320%2Fsh%2F5987d975-2f1f-3974-5aa9-4305b3d46f9d%2Fcbee06a12dd1268ce6b7d72fa9112ba8&title=bsidesLV2022%2B-%2BLab%2Bone%2B-%2B%2BConfigure%2Band%2BPlaying%2Bwith%2BCloudsplaining
@spookerlabs
spookerlabs / AWS API calls that return credentials.md
Created June 11, 2020 11:18 — forked from kmcquade/AWS API calls that return credentials.md
AWS API calls that return credentials
@spookerlabs
spookerlabs / StartLogging.xml
Created May 12, 2019 10:51 — forked from Cyb3rWard0g/StartLogging.xml
<Sysmon schemaversion="4.1">
<!-- Capture all hashes -->
<HashAlgorithms>*</HashAlgorithms>
<EventFiltering>
<!-- Event ID 1 == Process Creation. Log all newly created processes except -->
<ProcessCreate onmatch="exclude">
<Image condition="contains">splunk</Image>
<Image condition="contains">btool.exe</Image>
<Image condition="contains">SnareCore</Image>
<Image condition="contains">nxlog</Image>
@spookerlabs
spookerlabs / gist:d43bec75b5bf0c0557577b29b2204194
Created January 7, 2019 20:43 — forked from tonyc/gist:1384523
Using strace and lsof

Using strace and lsof to debug blocked processes

You can use strace on a specific pid to figure out what a specific process is doing, e.g.:

strace -fp <pid>

You might see something like:

select(9, [3 5 8], [], [], {0, 999999}) = 0 (Timeout)

@spookerlabs
spookerlabs / certstream_watchdog_paypal.py
Created January 7, 2019 02:56 — forked from PaulSec/certstream_watchdog_paypal.py
certstream utility to retrieve paypal and few other fraud keywords
import certstream
keywords = ['paypal', 'paypol']
def extract_domains(domains):
res = []
for domain in domains:
for keyword in keywords:
if keyword in domain:
res.append(domain)
@spookerlabs
spookerlabs / tweet_dumper.py
Created January 7, 2019 02:55 — forked from PaulSec/tweet_dumper.py
A script to download all of a user's tweets into a csv
#!/usr/bin/env python
# encoding: utf-8
import tweepy #https://github.com/tweepy/tweepy
import csv
#Twitter API credentials
consumer_key = ""
consumer_secret = ""
access_key = ""
@spookerlabs
spookerlabs / cheatsheet-elasticsearch.md
Created October 18, 2018 03:19 — forked from ruanbekker/cheatsheet-elasticsearch.md
Elasticsearch Cheatsheet
@spookerlabs
spookerlabs / bro-ids_logstash.conf
Created August 28, 2018 17:40 — forked from mrlesmithjr/bro-ids_logstash.conf
# Bro-IDS Logstash parser
# Parts of this taken from http://www.appliednsm.com/wp-content/uploads/logstash-SObro22-parse.conf_.txt
#Logs being parsed:
#app_stats.log
#conn.log
#dns.log
#dpd.log
#files.log
#http.log
@spookerlabs
spookerlabs / audit.rules
Last active June 18, 2018 13:37 — forked from Neo23x0/audit.rules
Linux Auditd Best Practice Configuration
# ___ ___ __ __
# / | __ ______/ (_) /_____/ /
# / /| |/ / / / __ / / __/ __ /
# / ___ / /_/ / /_/ / / /_/ /_/ /
# /_/ |_\__,_/\__,_/_/\__/\__,_/
#
# Linux Audit Daemon - Best Practice Configuration
# /etc/audit/audit.rules
#
# Compiled by Florian Roth