Skip to content

Instantly share code, notes, and snippets.

View yosignals's full-sized avatar

John Carroll yosignals

View GitHub Profile
@yosignals
yosignals / gist:3657b1cbcec2597b4249497fea75bcf1
Last active December 23, 2022 14:32
(Go) Hash Counter, If you're dumping NTDS.dit hashes and you want to see what are worth focusing on the most (time pressure) this will list the duplicates with the top 40 offenders in highest volume - go run hashhosh.go it will need hashes.txt in the same folder
package main
import (
"bufio"
"fmt"
"os"
"sort"
)
func main() {
@yosignals
yosignals / gist:80db7d8d06f8060abd0eecde933c9c68
Created December 22, 2022 18:59
Useful for separating a mix of hashes, my use case was historical breach data where uncracked passwords where varying in Hash type, this aims to try and sort through them into files you can throw at hashcat or JtR
import hashlib
def sort_hashes(filename):
# Create a list of hash types
hash_types = [
'md5',
'sha1',
'sha224',
'sha256',
'sha384',
# Get the current date and time
$date = Get-Date
# Get a list of all open TCP connections
$tcpConnections = Get-NetTCPConnection
# Create a table to display the results
$table = New-Object System.Data.DataTable
$table.Columns.Add("Local Address")
$table.Columns.Add("Local Port")
@yosignals
yosignals / whomstve
Created January 2, 2023 13:01
Grab IP4 and 6 Addresses from your logs and run local whois against them (recommending appending '| tee output.log '
package main
import (
"bufio"
"fmt"
"os"
"os/exec"
"regexp"
"sort"
)
@yosignals
yosignals / Dynamic Subdomain C2 and or Exfil
Created January 3, 2023 21:49
Dynamic Subdomain C2 Exfil detection - Splunk Query
# Select events from all indexes
index=*
# Extract the subdomain from the domain field and add a new field called "subdomain"
| eval subdomain=split(domain, ".")[0]
# Format the time field into a more human-readable format and add a new field called "time"
| eval time=strftime(_time, "%Y-%m-%d %H:%M:%S")
# Bin the time field into 2 minute intervals and add a new field called "bin_time"
package main
import (
"bufio"
"fmt"
"os"
"fyne.io/fyne/v2"
"fyne.io/fyne/v2/app"
"fyne.io/fyne/v2/container"
@yosignals
yosignals / gist:c426aeabbf3727140b9d88f567b38eb4
Created February 20, 2023 10:25
Subslplit.py | some (excellent) pen testing tools have a hard time outside of /24 and smaller networks, this little script tries to address that by fragmenting large networks into palatable lists
import ipaddress
import os
# Get the IP address range from the user
ip_range = input("Enter IP address range (CIDR notation): ")
# Convert the IP address range to an object of type ipaddress.IPv4Network
ip_net = ipaddress.IPv4Network(ip_range)
# Get the number of target files from the user
package main
import (
"bufio"
"flag"
"fmt"
"os"
"sort"
)
@yosignals
yosignals / HCex.go
Last active March 29, 2023 14:03
Converting those Hashcat $HEX[] results into something useful
package main
import (
"bufio"
"encoding/hex"
"fmt"
"os"
"regexp"
"strings"
)
@yosignals
yosignals / CVSS31Gen.go
Created March 30, 2023 12:20
Generate random CVSS 3.1 vector strings
package main
import (
"flag"
"fmt"
"math/rand"
"strings"
"time"
)