Dec 042013
 

This is somewhat related to updating amazon group resource ip’s for dynamic ip addresses except it is a different concept.  How many times have you been on the road and needed to access your home computer?  Granted, there are many third party services that allow you to do that, like dynamic dns but that is behind my control.  I wanted something I could control.  Since I use linode, they have an api and a way to script ip updates.  So thats what we will do here.

Continue reading »

Dec 042013
 

I often review various vulnerability scanners.  When I review them, I look at several different things:

  • were they able to find a vulnerability I previously missed?
  • are they accurate in their findings?
  • how quickly do they complete an audit compared to “insert some other vulnerability scanner here”?
  • sometimes I will also grab the tcpdumps of the audits for even further analysis
  • how accessible and easy are they to use by “skiddies”?
  • based on the tcpdumps + noise generated on the server logs, are the audit signatures of wapiti easy to detect?

Continue reading »

Nov 212013
 

I work from home a lot.  My ISP used to never change IP addresses dynamically the first 3 years or so I was with them.  Now they change it often (more than once a week).  This creates a slower response time when I am at home, get a page, go to log in via ssh, and find out my ip has changed since we restrict our AWS environment via group policies.  The times I have needed to do this are relatively few, but still its a problem if there is an emergency.  Leave it to me to come up with a simple solution….

Continue reading »

Nov 182013
 

Openx has been a pain in my ass for some time now (5 years).  Even if you have the latest most up to date software release, you will still get append and prepend infections.  I’m not sure if it comes from client browsers when they log in or some other reason.  What I can assure you is that the file system in which openx resides is as secure as it can be while leaving openx functional (all files are owned by a different user than the web server process and are only readable by the web server.  All directories, except two, are also owned by a different process than the web server and are read only….while two have to be writable by the web server process.  The lamp stack is also up to date.).  Anyways, even with these restrictions, clean code, clean db, limited plugins, and even checked the meta data of all image files for backdoors (I first learned about this technique in approx 2010 but here is an article from 2011 detailing this – PHP Code into JPEG Metadata: From hide to unhide ) we still get an occasional append/prepend infection.

How to stop it?  This is pretty easy, I simply wrote a script that checks for append/prepend problems, logs if clean, logs and alerts if infected, and also disinfects.  This only works, if the append and prepend is NOT being used in your ads.

Continue reading »

Oct 272013
 

This is a really simple fix which will block the user enumeration on a wordpress site (like the method by wpscan).

Before I get into this, I am very well aware of the IfIsEvil page on nginx wiki.  But it also says on this page, “The only 100% safe things which may be done inside if in location context are:  return and rewrite as the last statement in a location block”  With that in mind, we are going to use ONLY rewrite as the last statement in our location block.

Continue reading »

Aug 262013
 

If you get these errors…..

insserv: warning: script 'S85vpnagentd_init' missing LSB tags and overrides
insserv: warning: script 'vpnagentd_init' missing LSB tags and overrides
insserv: There is a loop between service rmnologin and mountnfs if started
insserv:  loop involving service mountnfs at depth 7
insserv:  loop involving service networking at depth 6
insserv: There is a loop between service rmnologin and mountnfs if started
insserv: Starting vpnagentd_init depends on rmnologin and therefore on system facility `$all' which can not be true!
insserv: Starting vpnagentd_init depends on rmnologin and therefore on system facility `$all' which can not be true!
insserv: Starting vpnagentd_init depends on rmnologin and therefore on system facility `$all' which can not be true!
insserv: Max recursions depth 99 reached
insserv:  loop involving service nfs-common at depth 4
insserv:  loop involving service pulseaudio at depth 13
insserv: exiting now without changing boot order!

The fix is….

Continue reading »

Jun 092013
 

I just bought this card to replace an older radeon 4500 series gpu.  Here are the benchmarks (this is a quad-core amd with 16GB memory, sata drives):

Pyrit

$ sudo pyrit benchmark
Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+
 
Running benchmark (59139.3 PMKs/s)... - 
 
Computed 59139.26 PMKs/s total.
#1: 'CAL++ Device #1 'AMD GPU DEVICE'': 59710.6 PMKs/s (RTT 1.1)
#2: 'CPU-Core (SSE2)': 568.9 PMKs/s (RTT 3.0)
#3: 'CPU-Core (SSE2)': 572.3 PMKs/s (RTT 2.9)
#4: 'CPU-Core (SSE2)': 548.1 PMKs/s (RTT 3.0)

Continue reading »

Jun 062013
 

This is a trick I learned a long time ago.  I used to teach it in my linux administration, digital forensics, and ethical hacking courses I taught at college.  It has been one of the most useful commands I ever learned.  So the scenario goes like this:  lets assume you have a user you suspect is doing something nefarious…maybe even a hacker has a shell on your server.  You would like to be able to see exactly what they are doing.  Wouldn’t it be nice to be able to connect to their shell without them knowing so you can watch what they are doing?

Here is how it is done…..

Continue reading »

Jun 012013
 

I finally got around to upgrading my desktop from Backtrack 5R3 to the latest Kali Linux.  After about two weeks, I finally set out to get the ati graphics card working so I could do some password cracking.  This turned into fun as the version of fglrx-drivers don’t support my 4500 series graphics card.  The fglrx-drivers-legacy don’t exist in the kali or debian repo’s.  Trying to install from the ati legacy drivers bundle failed.  Here is how I got it working using debian packages:

First add the correct repos:

Continue reading »

May 312013
 

Mostly doing this article as a note for the correct way to install java jdk or runtime for kali or debian wheezy.

Download either the jdk or jre tar.gz package from oracle

Install the java-package from debian

apt-get install java-package

Continue reading »