Ivan Marković Ivan-Markovic

Anti-hype LLM reading list

Goals: Add links that are reasonable and good explanations of how stuff works. No hype and no vendor content if possible. Practical first-hand accounts of models in prod eagerly sought.

Foundational Concepts

Pre-Transformer Models

TokyoWesterns CTF 2020 | writeups by @terjanq

Urlcheck v1 (98 points, 160 solves)

The goal was to bypass WAF protection to access local resources.

app.re_ip = re.compile('\A(\d+)\.(\d+)\.(\d+)\.(\d+)\Z')

def valid_ip(ip):
 matches = app.re_ip.match(ip)

Awesome Github OSINT

nil0x42's tips & tricks

📜 get-github-followers-twitter.py

Scrape twitter account of all github followers of target user on GitHub

📜 get-github-stargazers-twitter.py

Scrape twitter account of all stargazers of target project on GitHub

Rank	Type	Prefix/Suffix	Length
1	Prefix	my+	2
2	Suffix	+online	6
3	Prefix	the+	3
4	Suffix	+web	3
5	Suffix	+media	5
6	Prefix	web+	3
7	Suffix	+world	5
8	Suffix	+net	3
9	Prefix	go+	2

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	// dllmain.cpp : Defines the entry point for the DLL application.

	#include "pch.h"
	#include <stdio.h>
	#include <stdlib.h>

	#define _CRT_SECURE_NO_DEPRECATE
	#pragma warning (disable : 4996)

	// generated with sharpdllproxy.

	#!/bin/bash
	# Usage : ./scanio.sh <save file>
	# Example: ./scanio.sh cname_list.txt

	# Premium
	function ech() {
	spinner=( "\|" "/" "-" "\\" )
	while true; do
	for i in ${spinner[@]}; do
	echo -ne "\r[$i] $1"