| #!/bin/bash | |
| set -e | |
| GO_VERSION="1.20.6" | |
| GO_URL="https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" | |
| EXPECTED_CHECKSUM="b945ae2bb5db01a0fb4786afde64e6fbab50b67f6fa0eb6cfa4924f16a7ff1eb" | |
| # Log output of script | |
| exec > >(tee -i /home/ubuntu/install.log) | |
| exec 2>&1 |
| using System; | |
| using System.Collections.Generic; | |
| using System.DirectoryServices.Protocols; | |
| using System.Globalization; | |
| using System.Linq; | |
| using System.Runtime.InteropServices; | |
| using System.Runtime.InteropServices.ComTypes; | |
| using System.Security.Policy; | |
| using System.Text; | |
| using System.Threading.Tasks; |
| #!/usr/bin/env python | |
| # Super dirty python3 scripts that alerts Cobalt Strike operator using pushover when a new IP is found amoung network interface on beacon | |
| # Aggressor script for triggering this : https://gist.github.com/Flangvik/c31b26129743be699133dc9dab9c02c5 | |
| import argparse | |
| from datetime import datetime | |
| from base64 import b64encode,b64decode | |
| from pushover import init, Client | |
| from os import path | |
| parser = argparse.ArgumentParser(description='beacon info') |
| #AntiVirus Query | |
| #Author: @r3dQu1nn | |
| #Queries the Registry for AV installed | |
| #Thanks to @i_am_excite and @merrillmatt011 for the help | |
| #Props to @zerosum0x0 for the wmic find! | |
| #Long ass one-liner :) | |
| $powershellcmd = "\$av_list = @(\"BitDefender\", \"Kaspersky\", \"McAfee\", \"Norton\", \"Avast\", \"WebRoot\", \"AVG\", \"ESET\", \"Malware\", \"Windows Defender\");\$av_install = Get-ItemProperty HKLM:\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*;\$av_install1 = Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*;\$regkey = 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Signature Updates\\';\$av_loop2 = foreach (\$av1 in \$av_list){foreach (\$key in \$av_install){if (\$key.DisplayName -match \$av1 -eq \$TRUE){% {\"{0}|{1}|{2}\" -f \$key.DisplayName.ToString(), \$key.DisplayVersion.ToString(), \$key.InstallDate.ToString()}}}};\$proc_temp = Get-Process;\$av_loop = foreach (\$av in \$av_list){foreach (\$zz in \$proc_temp){if (\$zz.path -match \$av -eq \$TRUE) |
If you or your team is writing web applications, one of the most powerful defense tools at your disposal is good application logging. Writing code to generate logs used to be one of my least favorite programming “chores''. As I’ve grown in my career I’ve learned the importance of proper logging and its role in the success of an application. Proper logging helps not only from a debugging standpoint, but it can help you catch an attacker and I’ll describe one example of how you can implement this in your application.
Let’s imagine you have a simple application with an employee or user management page with typical endpoints such as:
GET, POST /employees and GET,PUT, DELETE /employee/{employeeId}
These endpoints would allow for CRUD (Create, Read, Update, Delete) and would absolutely be targeted by an attacker or pen tester conducting a web application assessment. One of the first things the attacker would do is fuzz the ID and place either a different ID or a bad ID to see if your application would eithe
| package main | |
| /* | |
| Example Go program with multiple .NET Binaries embedded | |
| This requires packr (https://github.com/gobuffalo/packr) and the utility. Install with: | |
| $ go get -u github.com/gobuffalo/packr/packr | |
| Place all your EXEs are in a "binaries" folder |
| <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | |
| <!-- | |
| File: Inveigh.xml | |
| Author: Kevin Robertson | |
| Description | |
| This file can be used to execute InveighZero through MSBuild. | |
| Original Repository: https://github.com/Kevin-Robertson/InveighZero | |
| Using msbuild.exe to execute .net code through inline tasks is a technique that | |
| was developed by Casey Smith. You can explicitly |
| :: Windows 10 Hardening Script | |
| :: This is based mostly on my own personal research and testing. My objective is to secure/harden Windows 10 as much as possible while not impacting usability at all. (Think being able to run on this computer's of family members so secure them but not increase the chances of them having to call you to troubleshoot something related to it later on). References for virtually all settings can be found at the bottom. Just before the references section, you will always find several security settings commented out as they could lead to compatibility issues in common consumer setups but they're worth considering. | |
| :: Thank you @jaredhaight for the Win Firewall config recommendations! | |
| :: Thank you @ricardojba for the DLL Safe Order Search reg key! | |
| :: Best script I've found for Debloating Windows 10: https://github.com/Sycnex/Windows10Debloater | |
| :: | |
| ::####################################################################### | |
| :: | |
| :: Change file associations to protect against common ransomware |
| # cat firefox.sh >> ~/.bashrc | |
| # Usage - subf_ff target.tld | |
| # asset_ff target.tld | |
| subf_ff () { | |
| subfinder -d $1 -silent - t 100 | httprobe -c 50 | sort -u | while read line; do firefox $line; sleep 10; done | |
| } | |
| asset_ff () { | |
| assetfinder -subs-only $1 | httprobe -c 50 | sort -u | while read line; do firefox $line; sleep 10; done |