Right-click on a VM, open the properties and there you can resize the disk. However, at least Windows, will show a disk size equal to 20GB by default and even if you change the disk size nothing seems to happen. You need to use the partition tool of Windows to resize the disk, in fact there will be an empty space unused.

Some virtual machines don't provide a way to share folders. In general you need to install some add-ons. An easy solution is to use a mini-ftp server. You can use python on the host machine running python -m pyftpdlib -w inside the folder you want to share (-w is for the writing permission). Then, you can easily access that folder from the guest machine with a ftp client or directly with the file explorer.

Following this tutorial you can emulate the Raspberry Pi 2 on Linux, but keep in mind that it will not be really fast.
First of all, download the official Raspbian image. If you're not interested in the desktop environment, I suggest to download the stretch lite version. Then unzip the image and convert into the qcow format:
Then, download the kernel-qemu-4.4.1-vexpress and vexpress-v2p-ca9.dtb clicking the links or from this repository.
Put all the files in the same folder and run the following command to start the emulator with raspbian:
The emulator should boot the raspbian image, remember that the user is pi and the password raspberry by default.
You can enable the ssh service with systemctl enable ssh or using the raspi-config commands.

Expand the image size

At this point we need to resize the image, because the raspberry has few memory available by default (i.e. we can't install too many applications, etc.).

1. Expand the virtual size of the image using:
   $ qemu-img resize raspbian_stretch.qcow +10G
2. Boot raspbian and inside the emulator use fdisk to manage the partitions:
   $ fdisk /dev/sda
   Display the partitions using the p command. Note the beginning of the second partition block of the output (call this value INITP). Delete the second partition with the d command then 2. If you again display the partitions it has disappeared. Create a new partition with n then p then 2. There fdisk provides a value for the starting block. This must match the value that you have identified earlier (INITP). The following value is the end block that is the largest possible to fill all the space If you display the information again you will see that your new partition has a end higher so that means that the partition is larger. Back up the information with w command. Restart the machine.
3. Enlarge the filesystem. Once again connected, your partition is not increasing ! The partition has been resized well but not the filesystem ! And this is our last step. It is very simple, you just need to run $ resize2fs /dev/sda2. You can check the result running $ df -h before and after resize2fs.

In order to find the kernel start address of an Android (64-bit) device, first of all you need to extract and decompress the kernel from the boot.img. At this point you can run the following command:
This one-line command extracts all the hard-coded 64-bit addresses (sed "s/c0ffffff/c0ffffff\n/g" | grep -o '.\{16\}$'), then convert these addresses from little-endian to big-endian, sort and print them. In the first lines you will have the smaller addresses, one of them should be the start address of the kernel.

Sometimes there is the need to find the cross-references to a string in a binary. First of all, we need to know what is the address of the string. This is possible running the following command:
Then, you can look inside the decompiled binary (e.g. with objectdump) where the string's address is referenced. Note that often there isn't the "direct" address, but the base address of the rodata section is stored in a register and then the string's address is calculated adding the offset.

Sometimes you may need to view the traffic of other clients connected to a wireless access point. In other word, you need to have a situation where every client (or maybe just you) can view the traffic of the others, like if they were directly connected through an hub. This can be achieved with iptables, because it can mirror the traffic to a specific client.
Look at this example: In this way, all the traffic of the subnet 11.12.13.0/24 (of the wifi accesspoint) is mirrored to a specific client (i.e. 11.12.13.14). A workaround to mirror the traffic also to other clients, or all the clients of the subnet, is to repeat the previous two lines for each client you want to mirror the traffic to.

This is a simple bash function that implements a TCP port scanner based on netcat. I wrote it because I was connected to a machine without nmap installed on it and without enough privileges to install it.

Volatility is a great tool for memory forensics. However, you can just grep the process list with one line! In this way you don't need to know the memory layout. I'm using ripgrep, but you can use also a normal grep with perl regular expression support. All the processes information are strings (including the pid) and the keyword to look for is 'Win32_Process'.