Skip to content

Instantly share code, notes, and snippets.

View wh1t3h47's full-sized avatar
:octocat:
Escape the matrix!

Antônio Martos Harres wh1t3h47

:octocat:
Escape the matrix!
51 followers · 143 following
View GitHub Profile
@wh1t3h47
wh1t3h47 / qemu_portfwd.sh
Last active May 13, 2025 17:19
Qemu port forwarding for Android, ADB + Frida for reverse engineering. Host to Client server forwarding in order to share files via http. Host IP in client is http://192.168.122.1
#!/usr/bin/env bash
set -euo pipefail
[ "$#" -eq 1 ] || { echo "Usage: $0 <domain>" >&2; exit 1; }
[ "$EUID" -eq 0 ] || { echo "Run as root" >&2; exit 1; }
domain=$1
read network mac <<<"$(virsh domiflist "$domain" | awk '/network/ {print $3, $5; exit}')"
[ -n "$network" ] || { echo "Error: cannot detect network for domain '$domain'" >&2; exit 1; }
@wh1t3h47
wh1t3h47 / note.txt
Created April 3, 2025 14:11
C Hacking Note
Strcmp: Compare strings.
Strcmp is used to compare strings, and therefore don't have buffer overflow write.
However, if the first argument string is somehow not null terminated, and the
second string is an attacker controlled one and I have some indicator of this
comparison matching or not (I.e. Crashing and service restarts), I could
theoretically have an arbitrary out-of-bounds read.
It's a complicated attack that would require to bruteforce the memory until it matches,
timing information could be used to further aid into the exploitation with the right
@wh1t3h47
wh1t3h47 / Webdav
Last active February 20, 2025 05:50
Webdav python implementation, simple, efficient and easy barebones
import socket
from datetime import datetime, timezone
import os
import subprocess
# Server LDAP
# IMPORTANTE: Crédito wh1t3h47 - LLM, pode usar o conteúdo apenas se atribuir crédito em comentários e explicação a minha pessoa
HOST = "127.0.0.1"
@wh1t3h47
wh1t3h47 / run-on-pyvenv.sh
Last active February 6, 2025 01:08
Install Gentoo local .venv modules as if system-wide installed, for vscode extensions
#!/usr/bin/env bash
: <<'----------------------DESCRIPTION----------------------'
Why? Some vscode extensions like ms-python and ms-pyright don't play well with venv and fail to
install their dependencies in Gentoo Linux (auto completion based on type for vscodium without
using pylance)
How to use this? This script is an utility to make python3 venv binaries or scripts look like they
are natively installed, that is, because gentoo doesn't allow pip install
@wh1t3h47
wh1t3h47 / drission_page_threads.py
Last active January 6, 2025 03:32
Using Drission page - concurrency with threads/ thread pools, no locking, working and tested
'''
multiple threads / tabs concurrency drission
This works when twisted being used, but not the most recommended method, leaving note here for "backup" of a tested method
'''
from typing import Callable, Iterable, Optional, Tuple, cast
from concurrent.futures import ThreadPoolExecutor
from DrissionPage import ChromiumPage
@wh1t3h47
wh1t3h47 / sample_bruteforce.js
Last active January 12, 2025 02:13
Sample bruteforce javascript, fetch, batch processing
(async () => {
const doBruteforce = async (x, y) => {
console.log(x,y)
try {
const r = await fetch("http://localhost/example", {
"credentials": "include",
"headers": {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8",
"Accept-Language": "en-US,en;q=0.5",
@wh1t3h47
wh1t3h47 / gist:73424e69244cf0ed9be890f8af99b93b
Last active January 6, 2025 03:30
Advogado para previdência/ Aposentadoria/ Pensionista
@wh1t3h47
wh1t3h47 / gist:a1571d4ea96f37713e036a3b02509f47
Last active October 2, 2024 04:05
Convert all excel in ./ to csv
from os import listdir
import pandas as pd
for f in listdir():
if f.endswith('xlsx'):
df = pd.DataFrame(pd.read_excel(f))
csv_f = f[:-4:] + 'csv'
df.to_csv(csv_f, index=None, header=True)
continue