Skip to content

Instantly share code, notes, and snippets.

View gsuberland's full-sized avatar

Graham Sutherland gsuberland

158 followers · 0 following
View GitHub Profile
@gsuberland
gsuberland / infosec-keywords-reference.md
Last active November 11, 2025 04:22
Infosec keyword reference

Infosec keywords

This is just a big ol' list of keywords to search and learn about. No particular order. Search each of these and learn a bit about it, and try out all of the techniques you can manage.

Remember to focus on understanding the actual technology you're targeting. Security is fundamentally about learning what the computer actually does, so you can identify cases where the intent doesn't match the practical behaviour. Spend the time to understand the behaviours that you're exploiting, rather than just memorising the tricks - my old boss always used to say "we can teach computer people security, we can't teach security people computers", and it's very true.

  • Reflected and stored XSS
  • HttpOnly / Secure cookie flags
  • HTTP security headers
  • Content Security Policy
@gsuberland
gsuberland / BalloonHash.cs
Created October 30, 2025 08:35
An implementation of balloon hashing in C#
/*
An implementation of Balloon Hashing in C#
This hasn't been thoroughly tested and it SHOULD NOT BE USED FOR PRODUCTION.
Balloon hashing is a fairly easy way to turn any cryptographic hash function
primitive into a memory-hard and parallelisable password storage funciton or
key derivation function (KDF).
@gsuberland
gsuberland / find_skewed_cues.py
Created September 24, 2025 01:25
script to find tracks that have skewed cue positions in rekordbox
from pyrekordbox import Rekordbox6Database
from pyrekordbox.db6 import tables
import sqlalchemy
from uuid import uuid4
import datetime
db = Rekordbox6Database(key='this is not actually the key you will need this from somewhere else *ahem*')
query = db.query(tables.DjmdContent)
results = query.all()
@gsuberland
gsuberland / mastodon_reinstate_title_text.user.js
Last active November 19, 2025 13:04
Greasemonkey / Tampermonkey script to bring back hoverable alt text in Mastodon 4.4
// ==UserScript==
// @name Mastodon 4.4 - Reinstate title text!
// @namespace http://tampermonkey.net/
// @version 2025-11-19b
// @description Restores alt text in the title attribute of images and videos, allowing the alt text to be viewed in a tooltip while hovering with the mouse. See https://github.com/mastodon/mastodon/issues/33799
// @author Graham Sutherland
// @match https://chaos.social/*
// @grant none
// ==/UserScript==
@gsuberland
gsuberland / mastodon_feed_link_reorder.user.js
Created July 20, 2025 08:49
Mastodon feed link reordering userscript.
@gsuberland
gsuberland / HarmonyStubGenerator.cs
Last active July 31, 2024 23:07
C# code to generate Harmony prefix and postfix stubs against a target type
public class Target
{
private void Test1()
{
}
private string Test2()
{
return "";
@gsuberland
gsuberland / mastodon_local_link.user.js
Last active January 25, 2025 01:38
Tampermonkey script that adds a link to view remote posts locally.
@gsuberland
gsuberland / ClusterFunctionsByFID.java
Created May 7, 2023 20:05
Ghidra script to cluster functions by their function ID, applying tags to functions in clusters of size >1. Helps identify functions that have identical or very similar behaviour.
// Clusters functions by their function ID and applies tags to functions in clusters with a size larger than 1.
//@category FunctionID
//@author Graham Sutherland
import java.io.IOException;
import java.util.*;
import ghidra.app.script.GhidraScript;
import ghidra.feature.fid.hash.FidHashQuad;
import ghidra.feature.fid.plugin.HashLookupListMode;
@gsuberland
gsuberland / forced_alignment_srt.cs
Last active October 12, 2022 05:50
Automatic forced alignment transcription for creating timed SRT subtitles from a script document, using speech recognition.
/*
works in LinqPad 5 (.NET Framework)
requires System.Speech.dll to be loaded
*/
string script = @"
This is a test of automatic forced alignment transcription.
When I read these words, the program will automatically follow along and output SRT subtitle entries.
The code also handles situations where two lines in the script are the same.
For example, I can repeat the first line of this script:
@gsuberland
gsuberland / mastodon_unlist_replies.user.js
Created May 21, 2022 19:45
Tampermonkey / Greasemonkey script to automatically set the privacy of replies to unlisted by default on Mastodon.
// ==UserScript==
// @name Mastodon Unlisted Replies
// @namespace http://tampermonkey.net/
// @version 0.1
// @description Sets the privacy of replies to unlisted by default on Mastodon.
// @author Graham Sutherland (@gsuberland@chaos.social)
// @match https://chaos.social/* https://mastodon.social/*
// @icon https://www.google.com/s2/favicons?sz=64&domain=chaos.social
// @grant none
// @run-at document-idle