yosignals’s gists

yosignals / exclusions_catalog.csv SentinelOne

Created April 6, 2023 18:26

	# os_type application description value
	1 windows AutoCAD Interoperability Limitations with AutoCAD \Device\HarddiskVolume*\Program Files\Autodesk\
	2 windows AutoCAD Interoperability Limitations with AutoCAD \Device\HarddiskVolume*\Program Files\common Files\Autodesk\
	3 windows AutoCAD Interoperability Limitations with AutoCAD \Device\HarddiskVolume*\Program Files (x86)\Autodesk\
	4 windows AutoCAD Interoperability Limitations with AutoCAD \Device\HarddiskVolume*\Program Files (x86)\common Files\Autodesk\
	5 windows AutoCAD Interoperability Limitations with AutoCAD \Device\HarddiskVolume\Program File\Common Files\Autodesk Shared\
	6 windows AutoCAD Interoperability Limitations with AutoCAD \Device\HarddiskVolume\Program File\AutoCAD*\
	7 windows AutoCAD Interoperability Limitations with AutoCAD \Device\HarddiskVolume*\ProgramData\Autodesk\
	8 windows AutoCAD Interoperability Limitations with AutoCAD \Device\HarddiskVolume*\ProgramData\Flexnet\
	9 windows AutoCAD Interoperability Limitations with AutoCAD \Device

yosignals / MontyPortSniffingtonSlacksworthy.py

Last active May 1, 2023 11:50

something hits your port, you get a slack notification IP/NSLookup *added whois + time stuff + write out to local sqlite

	import socket
	import sys
	import subprocess
	import requests
	import json
	import time
	import sqlite3
	import select

	# Check for required packages and install them if needed

yosignals / Ditty.py

Last active June 9, 2023 11:29

Fake Domain dump generator and duplicate hash analyser reasons here > https://thecontractor.io/

	import random
	import string
	import hashlib

	def generate_fake_extract():
	domain = 'gchq.local'
	user_count = 1000 # Number of fake user accounts to generate

	fake_extract = []

yosignals / Publicker.py

Last active June 12, 2023 13:40

Publicker - A little script that takes your cracked passwords and cross references them against the SecList Passwords folder, exporting results to an external file citing the password and the location of the public wordlist it was seen in - more on this at https://thecontractor.io/publicker

	import os
	import requests
	import chardet
	import sys

	GITHUB_API = 'https://api.github.com'
	OWNER = 'danielmiessler'
	REPO = 'SecLists'
	BRANCH = 'master'
	DIR_PATH = 'Passwords'

yosignals / fake ditty.py sample

Created June 16, 2023 13:13

https://github.com/yosignals/ditty output

	https://github.com/yosignals/ditty/blob/main/fake.ditty.py

	gchq.local\rffpfosm:881723:a34e5a428ee058321df4d8da9abc4760:5d6dc7a7f094201c15fe39e3885bb45e:::
	gchq.local\keuqfzsq:849930:a34e5a428ee058321df4d8da9abc4760:a3d19bcf76a2fed12ba9b7d9a7f6c49d:::
	gchq.local\lyddkuyw:655741:a34e5a428ee058321df4d8da9abc4760:20314ac20f2d59988aab796ee782e464:::
	gchq.local\lyddkuyw:655741:a34e5a428ee058321df4d8da9abc4760:20314ac20f2d59988aab796ee782e464:::
	gchq.local\lyddkuyw:655741:a34e5a428ee058321df4d8da9abc4760:20314ac20f2d59988aab796ee782e464:::
	gchq.local\lyddkuyw:655741:a34e5a428ee058321df4d8da9abc4760:20314ac20f2d59988aab796ee782e464:::
	gchq.local\lyddkuyw:655741:a34e5a428ee058321df4d8da9abc4760:20314ac20f2d59988aab796ee782e464:::
	gchq.local\lyddkuyw:655741:a34e5a428ee058321df4d8da9abc4760:20314ac20f2d59988aab796ee782e464:::

yosignals / Ex-Machina.py

Last active August 7, 2023 09:11

a script that takes an IP or Email address as a parental starting point and pulls out child data, if this IP was used by bad, what emails have been liked to it in breach data more on that here https://thecontractor.io/breachdatareachdata/ to use this script you'll need a rehashed.com api key and email address (for credentials) and find your swee…

	import requests
	import time
	import json
	import sys

	api_endpoint = 'https://api.dehashed.com/search?query={}'
	credentials = ('YOUREMAIL', 'YOURAPI')
	headers = {'Accept': 'application/json'}

	checked_items = {}

yosignals / YoinClient.go

Last active August 12, 2023 18:48

this listens at the webroot and collects incommng requests, for /filename.ext/chunk_of_base64, until the sha1 in the first request is met

	package main

	import (
	"crypto/sha1"
	"encoding/base64"
	"encoding/hex"
	"fmt"
	"io/ioutil"
	"log"
	"net/http"

yosignals / twoiynk.py

Created August 25, 2023 10:50

Twitter dump duplicate joiner

	import os
	import re

	# Directory path where the txt files are stored
	folder_path = '.'

	# Adjusted regular expressions to match the given line format
	email_pattern = re.compile(r'Email: ([\w\.-]+@[\w\.-]+)')
	screen_name_pattern = re.compile(r'ScreenName: (\S+)')

yosignals / MACer

Last active August 30, 2023 08:28

Pulls down the Organizationally Unique Identifier's (OUI), cross references, joins and summarises groups of Mac addresses to the vendor, highlighting volume in percentages in a summary - great for wild asset things

	import urllib.request as urllib2
	import re
	from collections import Counter
	import csv

	def ParseIEEEOui(url="http://standards.ieee.org/develop/regauth/oui/oui.txt"):
	headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0'}
	req = urllib2.Request(url, headers=headers)
	res = urllib2.urlopen(req)
	data = res.read().decode()

yosignals / grabby.py

Created September 9, 2023 15:28

feed IPs to DeHashed API

	import requests
	import csv
	api_endpoint = 'https://api.dehashed.com/search?query={}'
	credentials = ('you@address.com', 'APIKEY')
	headers = {'Accept': 'application/json'}

	# Step 1: Read the IP addresses from a text file
	with open('ip_addresses.txt', 'r') as file:
	ip_addresses = [line.strip() for line in file]

John Carroll yosignals