Warnaud's Wiki - scripting:bash

chaosreader

anonymous@undisclosed.example.com (Anonymous) — Wed, 03 Nov 2021 16:15:56 +0000

url="";for file in `ls -S1 | head -10`; do url="https://www.virustotal.com/gui/file/`shasum $file | cut -d " " -f1` $url" ; done; firefox $url&

cleaning

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Jun 2023 06:36:31 +0000

Cleaning Developpers took years to develop a very NOT usefull feature: copy/paste with formatting ( by default !) To clean script where outputs is “hallucinating” like: # ./script.sh ./script.sh: line 1: !#/bin/bash: No such file or directory

dnssynchro

anonymous@undisclosed.example.com (Anonymous) — Thu, 17 Dec 2020 04:23:57 +0000

To check if the same host has the same resolution on several different DNS (from /etc/resolv.conf) on the same machine: for dns in `sed -n 's/^nameserver //p' /etc/resolv.conf`; do host -s thehost.toveri.fy $dns | awk '/has address/ {print $4}' > $dns ; done; diff `sed -n 's/^nameserver //p' /etc/resolv.conf` > /dev/null; if [ `echo $?` != 0 ]; then date ; grep [0-9] `sed -n 's/^nameserver //p' /etc/resolv.conf`; fi

exitcode

anonymous@undisclosed.example.com (Anonymous) — Thu, 17 Dec 2020 04:23:57 +0000

When you want to check/validate that a command ran fine, you need to recuperate its exit code. Again several ways: * Easy: command returnvalue=$? * All at once: returnvalue=$(command)$?

find

anonymous@undisclosed.example.com (Anonymous) — Tue, 22 Aug 2023 09:18:18 +0000

Reference * file find . -name file.txt file in specific dir find /var -name file.txt file with part of the name find /var -iname file.txt /var/file.txt /var/File.txt /var/FILE.TXT /var/FiLe.TxT Find Directories Using Name Find all directories whose name is Emre in /home directory.

history

anonymous@undisclosed.example.com (Anonymous) — Fri, 12 May 2023 08:57:52 +0000

History command by default returns an history of latest command ran on this login it is ~the latest “HISTSIZE” commands. it can differ with the options of HISTCONTROL (for example ignoredups which ignore duplicates) remove the number history | cut -d ' ' -f 4-

hosts

anonymous@undisclosed.example.com (Anonymous) — Wed, 29 Dec 2021 20:03:38 +0000

I always want to get rid of the sh*tload of ads/spywares/analitics/ crap downloaded by your browser. I have a solution on the DNS with Bind (using only one url to get an hosts file) see DNS on Raspberry Pi and DNS on OpenBSD. I now use 2 DNS at home. One running Bind with default config. Another running dnsmasq for my home dns entry and the ease to add all those funky domain to hell.

returnvar

anonymous@undisclosed.example.com (Anonymous) — Thu, 17 Dec 2020 04:23:57 +0000

When you want to save values between functions of your bash script, there are several ways: * Use the same variable name and don't create them as “local” to a function function myfunc() { myresult='some value' } myfunc echo $myresult :!:

volatility-check

anonymous@undisclosed.example.com (Anonymous) — Wed, 29 Dec 2021 20:13:34 +0000

Script which uses volatility 2.x + yara rules to extract tons of useful info #!/bin/bash # check if we have at least one file if [ $# -eq 0 ] then echo "No memory dump supplied" exit 0 fi DUMP=$1 # check if it exists if test -f "$DUMP"; then echo "Starting volatility analysis of $DUMP" else echo "$DUMP doesn't exist" exit 0 fi # Displays the step and add nice separations in the report function title(){ #echo -e "\n" #printf "[INFO] Extracting $1" echo "[INFO] Ex…