Skip to content

Instantly share code, notes, and snippets.

View aaarghhh's full-sized avatar

Giacomo Giallombardo aaarghhh

99 followers · 40 following
View GitHub Profile
@cliffordp
cliffordp / bypass-cloudflare-email-protection.js
Created February 16, 2024 16:31 — forked from neopunisher/bypass-cloudflare-email-protection.js
How to circumvent Cloudflare's [email protected] thing, WITHOUT enabling Javascript
// Adapted from https://raddle.me/f/Privacy/3722/how-to-circumvent-cloudflare-s-email-protected-thing-without with the help of chatGPT
function fixObfuscatedEmails() {
const elements = document.getElementsByClassName('__cf_email__');
for (let i = 0; i < elements.length; i++) {
const element = elements[i];
const obfuscatedEmail = element.getAttribute('data-cfemail');
if (obfuscatedEmail) {
const decodedEmail = decrypt(obfuscatedEmail);
element.setAttribute('href', 'mailto:' + decodedEmail);
element.innerHTML = decodedEmail;
@BushidoUK
BushidoUK / Malicious Hostnames.txt
Created June 14, 2023 21:19
Malicious Hostnames belonging to Malware Operators, Ransomware Groups, and Advanced Persistence Threats
WIN-QQ80VPAFRNH
84.252.95.225 - SolarMarker
37.120.237.251 - SolarMarker
217.138.205.170 - Ursnif
185.236.202.184 - Pegasus, NSO Group
DESKTOP-2NFCDE2
94.142.138.32 - Aurora Stealer
45.15.156.250 - Aurora Stealer
45.15.156.40 - Raccoon Stealer
@jerlendds
jerlendds / cses.json
Last active October 31, 2025 22:19
[
{
"label": "GEOSINTsearch",
"description": "Searches within posts from Twitter, Reddit and 4Chan and presents anything that contains a Google Maps link",
"value": "https://cse.google.com/cse?cx=015328649639895072395:sbv3zyxzmji"
},
{
"label": "Pasted tekst",
"description": "Look if any specifc text has been posted before",
"value": "https://cse.google.com/cse/publicurl?cx=013991603413798772546:nxs552dhq8k"
@tothi
tothi / krbrelay_privesc_howto.md
Last active April 23, 2025 01:59
Privilege Escalation using KrbRelay and RBCD

KrbRelay with RBCD Privilege Escalation HOWTO

Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.

TL;DR

No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.

Prerequisites:

  • LDAP signing not required on Domain Controller (default!)
@alexander-hanel
alexander-hanel / GORE.md
Last active October 14, 2025 04:12
Go Lang Reverse Engineering Resources/Links
@insi2304
insi2304 / Mimikatz-cheatsheet
Created July 23, 2020 08:15
Mimikatz Cheat Sheet
#general
privilege::debug
log
log customlogfilename.log
#sekurlsa
sekurlsa::logonpasswords
sekurlsa::logonPasswords full
@wxsBSD
wxsBSD / base64.md
Created December 3, 2019 03:25
Base64 modifier in YARA 
wxs@wxs-mbp yara % cat rules/test.yara
rule a {
  strings:
    // This program cannot VGhpcyBwcm9ncmFtIGNhbm5vdA==
    // AThis program cannot QVRoaXMgcHJvZ3JhbSBjYW5ub3Q=
    // AAThis program cannot QUFUaGlzIHByb2dyYW0gY2Fubm90
    $a = "This program cannot" base64

 // Custom alphabets are supported, but I have it commented out for now. ;)
@Neo23x0
Neo23x0 / Base64_CheatSheet.md
Last active October 5, 2025 22:13
Learning Aid - Top Base64 Encodings Table

Base64 Patterns - Learning Aid

Base64 Code Mnemonic Aid Decoded* Description
JAB 🗣 Jabber $. Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq 📺 Television MZ MZ header
SUVY 🚙 SUV IEX PowerShell Invoke Expression
SQBFAF 🐣 Squab favorite I.E. PowerShell Invoke Expression (UTF-16)
SQBuAH 🐣 Squab uahhh I.n. PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA 💪 "Pah!" &lt;. Often used by Emotet (UTF-16)
@hfiref0x
hfiref0x / akagi_58a.c
Created October 23, 2019 16:27
UAC bypass using EditionUpgradeManager COM interface
typedef interface IEditionUpgradeManager IEditionUpgradeManager;
typedef struct IEditionUpgradeManagerVtbl {
BEGIN_INTERFACE
HRESULT(STDMETHODCALLTYPE *QueryInterface)(
__RPC__in IEditionUpgradeManager * This,
__RPC__in REFIID riid,
@painor
painor / FastTelethon.py
Last active October 19, 2025 21:35
This will increase the download/upload speed when using telethon
# copied from https://github.com/tulir/mautrix-telegram/blob/master/mautrix_telegram/util/parallel_file_transfer.py
# Copyright (C) 2021 Tulir Asokan
import asyncio
import hashlib
import inspect
import logging
import math
import os
from collections import defaultdict
from typing import Optional, List, AsyncGenerator, Union, Awaitable, DefaultDict, Tuple, BinaryIO