Skip to content

Instantly share code, notes, and snippets.

View xinali's full-sized avatar
🎯
Focusing

xina1i xinali

🎯
Focusing
View GitHub Profile
@xinali
xinali / fofa_rule.sql
Created July 6, 2017 09:33 — forked from Tr3jer/fofa_rule.sql
fofa_rule.sql
/*
Navicat Premium Data Transfer
Source Server : localhost
Source Server Type : MySQL
Source Server Version : 50542
Source Host : localhost
Source Database : rule
Target Server Type : MySQL
apt update && apt install -y vim git wget curl
# get vimrc
wget https://gist.githubusercontent.com/xinali/e5ba9e33d2ab942d35dda7a0bfa98029/raw/d871f503e2aee014def04947d8c81c6d426769e7/vimrc -O ~/.vimrc
# install vim-plug
curl -fLo ~/.vim/autoload/plug.vim --create-dirs \
https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim
# install some plugin
@xinali
xinali / __vim_windows
Last active November 7, 2018 12:12
vim配置文件
set nocompatible
set encoding=utf-8
set lines=40
set columns=100
" set font in linux set guifont=Monospace\ 14
" set font in windows
set guifont=Consolas:h14
" for gvim
set guioptions-=T
@xinali
xinali / zshrc
Last active April 25, 2018 08:29
zshrc
# If you come from bash you might have to change your $PATH.
# export PATH=$HOME/bin:/usr/local/bin:$PATH
# Path to your oh-my-zsh installation.
export ZSH=/root/.oh-my-zsh
# Set name of the theme to load. Optionally, if you set this to "random"
# it'll load a random theme each time that oh-my-zsh is loaded.
# See https://github.com/robbyrussell/oh-my-zsh/wiki/Themes
ZSH_THEME="robbyrussell"
@xinali
xinali / payloads.py
Created May 6, 2018 07:13
Handle Payloads
#encoding:utf-8
import sys
from pwnlib.util.cyclic import cyclic, cyclic_find
def usage():
print """
====================================================
[*] python payloads.py s/g arg"
example:
@xinali
xinali / havex家族变异版本.txt
Last active July 12, 2018 07:24
havex家族样本
# havex_version_01
170e5eb004357dfce6b41de8637e1dbeb87fa58e8b54a2031aac33afb930f3c8
# havex_version_02
b647f883911ff20f776e0a42564b13ef961fa584ebd5cfce9dd2990bca5df24e
fb30c3bb1b25b3d4cca975f2e0c45b95f3eb57a765267271a9689dd526658b43
6606dd9a5d5182280c12d009a03b8ed6179872fcb08be9aa16f098250cc5b7a7
# havex_version_012
0c20ffcdf2492ccad2e53777a0885c579811f91c05d076ff160684082681fe68
@xinali
xinali / memdump.js
Created November 12, 2018 09:28
A Windbg script to trace memory functions , written in Javascript
/*
How to use :
.load jsprovider.dll
.scriptload memdump.js
bp MSVCR120D!free ".scriptrun memdump.js"
bp MSVCR120D!malloc ".scriptrun memdump.js"
*/
"use strict";
@xinali
xinali / Dockerfile
Last active November 16, 2018 09:26
docker for pwn
FROM ubuntu:latest
MAINTAINER xina1i [email protected]
ENV DEBIAN_FRONTEND noninteractive
# prequirements
RUN apt update && apt upgrade -y && apt install -y python python-pip python3-pip git vim curl wget sudo zsh wget curl
# install libheap
@xinali
xinali / gist:480907d714f67fad1077c01b5b3a2210
Created November 23, 2018 06:36 — forked from vnsam/gist:187be13c408b291f9b9c0a28c72fb7ff
Pro version key for Beyond Compare - v4.2.3.22587
This can be used in Mac by using following trick:
Open trial.key at path: /Applications/Beyond\ Compare.app/Contents/Resources/trial.key
Replace content of trial.key with:
--- BEGIN LICENSE KEY ---
H1bJTd2SauPv5Garuaq0Ig43uqq5NJOEw94wxdZTpU-pFB9GmyPk677gJ
vC1Ro6sbAvKR4pVwtxdCfuoZDb6hJ5bVQKqlfihJfSYZt-xVrVU27+0Ja
hFbqTmYskatMTgPyjvv99CF2Te8ec+Ys2SPxyZAF0YwOCNOWmsyqN5y9t
q2Kw2pjoiDs5gIH-uw5U49JzOB6otS7kThBJE-H9A76u4uUvR8DKb+VcB
rWu5qSJGEnbsXNfJdq5L2D8QgRdV-sXHp2A-7j1X2n4WIISvU1V9koIyS
================================================================================
Output generated by mona.py v2.0, rev 576 - Immunity Debugger
Corelan Team - https://www.corelan.be
================================================================================
OS : post2008server, release 6.2.9200
Process being debugged : dep_close (pid 3416)
Current mona arguments: rop -m kernel32.dll,ntdll.dll
================================================================================
2017-11-06 15:40:06
================================================================================