linux command line filter for ip address matches

$ cat file.log |grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' |sort -u

SEP: how can we detect 'application and device control feature' enabled on a sep client machine

Aşağıda bu kontrolü yapabileceğiniz birden fazla yöntem paylaşıyorum. İstediğiniz şekilde sonuç alamazsanız uygun zamanınızda beraber gözatabiliriz.

1.

Kurulum paketinizde yer alan setAid.ini dosyada yer alan;

"DCMain=1"

Application Control and Device Control yükleneceği anlamına gelir bu şekilde kontrol edebilirsiniz.

Örnek ekran görüntüleri:

Setup paketimi extract ettiğimdeki dosya içeriği:

2.

Diğer bir yöntem olarak aşağıdaki logları analiz ederek bunu tespit edebilirsiniz.

Monitors -> Logs -> Application and Device Control,

Monitors -> Logs -> Log type: Application and Device Control -> Advanced Settings -> Event Type: Application Control Driver -> View Log

3.

sc query sysplant

komutu ile application and device control tarafından kullanılan servis durumunu sorgulayabilirsiniz.

Örnek:

Komut satırından ram model ve hız bilgileri öğrenme

Windows komut satırından memory'ye ilişkin detay bilgiler öğrenme:

wmic MemoryChip get BankLabel, Capacity, MemoryType, TypeDetail, Speed
BankLabel  Capacity    MemoryType  Speed  TypeDetail
BANK 0     4294967296  24          1600   128
BANK 2     4294967296  24          1600   128

https://msdn.microsoft.com/en-us/library/windows/desktop/aa394347(v=vs.85).aspx

bWAPP: insecure web application testing box

bWAPP, or a buggy web application, is a free and open source deliberately insecure web application.
It helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities.
bWAPP prepares one to conduct successful penetration testing and ethical hacking projects.

What makes bWAPP so unique? Well, it has over 100 web vulnerabilities!
It covers all major known web bugs, including all risks from the OWASP Top 10 project.

Linux sistemin ping response dönüşünü engelleme

Aşağıdaki iptables komutu ile bunu gerçekleştirebilirsiniz.

iptables -I INPUT -p icmp --icmp-type echo-request -j REJECT

SS7 hack explained: what can you do about it?

https://www.theguardian.com/technology/2016/apr/19/ss7-hack-explained-mobile-phone-vulnerability-snooping-texts-calls

Symantec Endpoint Protection: SEPM üzerinden Sep Client nasıl disable hale getirilir?

SEPM ve client arasındaki haberleşme smc servisi sayesinde bina edilir. Eğer bu servis SEPM aracılığıyla kapatılırsa aradaki iletişim kesileceği için yeniden başlatılamaz. Dolasıyla bu SEPM üzerinden client tarafındaki servisin kapatılması tavsiye edilmez.

Symantec Endpoint Protection: client tarafında tanımlanan exception tanımları nasıl kontrol edilir?

SEPM (Symantec Enterprise Protection Manager) aracılığıyla tanımlanan exception tanımları client tarafında nasıl kontrol edilir?

Eğer windows kullanıyorsanız bu için açağıdaki registery yollarını kontrol edebilirsiniz.

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Exclusions\ScanningEngines\Directory\Admin

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Symantec\SymantecEndpoint
Protection\AV\Exclusions.

Version: 14MP2

Symantec Endpoint Protection: SEPM Clients ekranında nasıl search yapılır?

Client ekranında nasıl search yapılır?

Kalabalık client listesini yönetirken sıkça yönetilen bir soru bu. Bunun için sol menüde yer alan search clients yönlendirmesini kullanabilirsiniz.

Version: 14MP2

emacs tutorials

https://cestlaz.github.io/stories/emacs/

ZFS on Linux v0.7.0 released

[zfs-announce] v0.7.0 released

http://list.zfsonlinux.org/pipermail/zfs-announce/2017-July/000015.html

Extremely Fast MySQL Backup and Restore Using Mydumper/Myloader

Mydumper and Myloader are utility software programs that allow you to perform extremely fast and reliable multi-threaded MySQL backup and restore which is written in the C programming language.

It was initially developed by MySQL engineers who later moved to Facebook. Mydumper is approximately 10 times faster than the mysqldump tools typically used for backups.

https://wplobster.com/extremely-fast-mysql-backup-restore-using-mydumpermyloader/

ssh based vpn solution: xiringuito

SSH-based "VPN for poors"

VPN made easy! No configuration. No VPN servers. No hassle. Just plug and use!

This is the "VPN without VPN" software done using nice built-in capabilities of SSH.

https://github.com/ivanilves/xiringuito

Linux notları

Quick Reference Guide

https://perso.crans.org/~raffo/books/linux-guide.pdf

free, automated, and open Certificate Authority

Let’s Encrypt is a free, automated, and open Certificate Authority.

Ücretsiz güvenlik sertifikası edinebileceğiniz bir site.

Detaylar için aşağıdaki adresi inceleyebilirsiniz.

https://letsencrypt.org/docs/faq/

How to scan new FC LUNS and SCSI disks in Red Hat

Red Hat kullanılan sistemde multipath lun'ları taramak için uyguladığımız adımlar:

Aşağıdaki script'teki host0, host1, host2, host3 olarak belirttiğim ve tarama yaptığım aygıtlarını ihtiyacınıza göre düzenlemelisiniz. Örneğin, eğer sisteminizde host4 aygıtı bulunuyorsa bunu da eklemelisiniz.

Platform:

RHEL 6.5 x86_64

Code:

#!/bin/bash

##
# e-mail: aokany[at]gmail.com
##

mpathconf --disable
rm -fr /etc/multipath.conf
rm -fr /etc/multipath/bindings

service multipathd stop
sleep 3
echo "- - -" > /sys/class/scsi_host/host0/scan
echo "1" > /sys/class/fc_host/host0/issue_lip

echo "- - -" > /sys/class/scsi_host/host1/scan
echo "1" > /sys/class/fc_host/host1/issue_lip

echo "- - -" > /sys/class/scsi_host/host2/scan
echo "1" > /sys/class/fc_host/host2/issue_lip

echo "- - -" > /sys/class/scsi_host/host3/scan
echo "1" > /sys/class/fc_host/host3/issue_lip

mpathconf --enable

service multipathd start

fdisk -l |grep Disk |grep -v ident

WWDC 2017

Apple WWDC etkinliğinde yeniliklerini tanıttı.

IOS 11 ve donanım güncellemeleriyle ilgili detayları aşağıdaki adreste bulabilirsiniz.

https://techcrunch.com/events/wwdc-2017/

libtins: packet crafting and sniffing library

libtins is a high-level, multiplatform C++ network packet sniffing and crafting library.

Its main purpose is to provide the C++ developer an easy, efficient, platform and endianness-independent way to create tools which need to send, receive and manipulate network packets.

It uses a BSD-2 license and it's hosted at github.

High level != inefficient

libtins was designed keeping efficiency in mind at all times. In fact, it is one of the fastest packet sniffing and interpretation libraries available. The benchmark section contains some actual measurements of how fast it works.

http://libtins.github.io/

Cuckoo Sandbox

What is it? 

In three words, Cuckoo Sandbox is a malware analysis system.

In other words, you can throw any suspicious file at it and in a matter of seconds Cuckoo will provide you back some detailed results outlining what such file did when executed inside an isolated environment.

Malware is the swiss-army knife of cybercriminals and any other adversary to your corporation or organization.

In these evolving times, detecting and removing malware artifacts is not enough: it's vitally important to understand how they operate in order to understand the context, the motivations and the goals of a breach, for better protecting in the future

Cuckoo Sandbox is a free software that automated the task of analyzing any malicious file under Windows, OS X, Linux, and Android.

https://cuckoosandbox.org/

Volatile memory extraction utility framework

Volatility Framework - Volatile memory extraction utility framework 

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

 https://github.com/volatilityfoundation/volatility/wiki

Capture Live RAM

https://belkasoft.com/ram-capturer

Belkasoft Live RAM Capturer is a tiny free forensic tool that allows to reliably extract the entire contents of computer’s volatile memory – even if protected by an active anti-debugging or anti-dumping system. Separate 32-bit and 64-bit builds are available in order to minimize the tool’s footprint as much as possible. Memory dumps captured with Belkasoft Live RAM Capturer can be analyzed with Live RAM Analysis in Belkasoft Evidence Center. Belkasoft Live RAM Capturer is compatible with all versions and editions of Windows including XP, Vista, Windows 7, 8 and 10, 2003 and 2008 Server.


Why Memory Dump Is the First Thing To Do During the Acquisition

Memory dumps are a valuable source of ephemeral evidence and volatile information. Memory dumps may contain passwords to encrypted volumes (TrueCrypt, BitLocker, PGP Disk), account login credentials for many webmail and social network services such as Gmail, Yahoo Mail, Hotmail; Facebook, Twitter, Google Plus; file sharing services such as Dropbox, Flickr, SkyDrive, etc.

Find ORACLE_HOME

sqlplus>

SQL > var OH varchar2(200);
SQL > EXEC dbms_system.get_env('ORACLE_HOME', :OH) ;
SQL > PRINT OH

ifconfig.me: connection test

curl ifconfig.me

Get your external IP address

curl ifconfig.me/ip -> IP Adress

curl ifconfig.me/host -> Remote Host

curl ifconfig.me/ua ->User Agent

curl ifconfig.me/port -> Port

TheFatRat v1.8 - Easy Tool For Generate Backdoor with Msfvenom

What is TheFatRat ?

An easy tool to generate backdoor with msfvenom (a part from metasploit framework) and easy tool to post exploitation attack like browser attack,dll . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .

https://github.com/Screetsec/TheFatRat 

trojan-dropper: Dr0p1t-Framework

Features

Works with Windows and Linux

Adding malware after downloading it to startup

Adding malware after downloading it to task scheduler

Finding and killing the antivirus before running the malware

Running a custom (batch|powershell|vbs) file you have choosen before running the malware

In running powershell scripts it can bypass execution policy

Using UPX to compress the dropper after creating it

Choose an icon for the dropper after creating it

https://blog.malwarebytes.com/threats/trojan-dropper/

https://github.com/D4Vinci/Dr0p1t-Framework