J_K9 @ Linux

Silica - CANVAS On Debian On The Nokia 770 Internet Tablet

J_K9 — Sat, 10 Feb 2007 15:46:16 +0000

IMMUNITY Silica is a stunning new product whose tagline is “Redefining Penetration Testing.” Sporting an easy-to-use interface (as shown on its product page), this device allows you to scan wireless networks, perform vulnerability scans of computers on those networks, exploit some of those vulnerabilities at the touch of a button, find and store “interesting” and possibly confidential files, and much, much more, using a simplified and smaller version of IMMUNITY Inc.’s CANVAS product.

Silica was first shown running on Debian Linux on the Nokia 770 Internet Tablet, which is just larger than a mouse (and can do far more than it ;)).

While this device may be purchased by nefarious users to carry out illegal activities, IMMUNITY Inc. is doing its best to sell Silica to penetration testers and security professionals who will use this device responsibly.

Handheld 802.11 penetration testing by hitting a few buttons and letting the device perform an automated process while resting inside your pocket? It sounds very cool indeed. Ryan Naraine has published a more in-depth review of it on his ZDNet blog.

The Problem With PHP Application Security

J_K9 — Sat, 13 Jan 2007 20:40:06 +0000

PHP application security and the vulnerabilities which are often found in PHP apps have already been discussed at length. PHP is a great language, but it suffers in that it provides no simple method of escaping special characters when handling input and thus leaves many budding programmers’ web applications vulnerable to remote file inclusion (RFI) exploits, Cross Site Scripting (XSS), SQL injection and a host of other remote exploitation techniques which may allow the attacker to steal confidential data (such as clients’ credit card details), disrupt services and cause many other problems. These techniques allow the attackers to use the web application to do things it was not originally designed for.

The programmer in question can be blamed to a certain extent for not reading up on how to secure their web application, but the problem is that many new programmers are not aware of the fact that they need to escape and clean the data they receive from the application’s inputs in order to stop it from doing what it was not designed to do. They are probably unaware that such types of attacks exist anyway. However, PHP provides limited, complex and slightly obscure functions to secure input handling which are usually insufficient and lack the functionality required to prevent certain attacks. Worse still, many books and tutorials written to teach people with no previous experience how to code in PHP usually omit secure data handling techniques or tips, and provide examples thoughout the book/tutorial which are vulnerable to the attacks mentioned above! This is irresponsible on the authors’ behalf: it’s no wonder that PHP application vulnerabilities accounted for 43% of the security issues found in 2006.

However, all hope is not lost. The Open Web Application Security Project (OWASP) have produced a set of PHP filters which allow the newest of PHP programmers to secure their input data handling methods. Doing so is a simple as downloading the filters, including them in the web app (with a command such as require_once(’sanitize.inc.php’)), storing the input into a variable and then sanitizing the data as shown on the project’s homepage.

It would be better if the PHP developers added functions such as OWASP’s PHP filters into the PHP code itself and if the authors of PHP instruction material added sections on securing input handling, but these filters are far better than nothing

SnortVM

J_K9 — Mon, 18 Sep 2006 06:56:02 +0000

As I’ve been inundated with work, I haven’t had much time to post anything. So, here’s a little something, to show you that I am, contrary to popular belief, still alive

CentOS is one of the most popular Linux server distributions, Snort the most popular Open Source IDS (Intrusion Detection System), and VMware Server quite possibly the most popular free (as in beer) virtualisation app. Now, what could you do to tie these together to make an amazing, free product? Install Snort on CentOS in a VM, and release it for public download, of course!

So, fresh from the, er, streets: SnortVM. Deploy it wherever you want, and discover things you didn’t know before. Why not bridge it with your main connection to your router on your home PC? That way, you can find out if anything nasty is getting past your router. Or even put it in the DMZ, for a bit of fun?

I quote:

This VMWare is a basic build of Snort using BASE and MySQL on CentOS 4.3. It was contributed by Patrick Harper and is based on his popular Snort Installation Guide. Patrick tested the image in VMware player, ESX 3, and Workstation 5.X. It’s backward compatible so those running older versions of Workstation will be able to use it too. The download is 427 MB

This is the most interesting VM I have seen in quite a while… So, run along and download it!

(You will need an app like VMware Player or VMware Server (both free) to run it)

SpamMailBag.com

J_K9 — Sat, 26 Aug 2006 01:09:30 +0000

I’m participating in a project started by HTRegz, a friend of mine. It is called SpamMailBag. What is its purpose? Well, I think HT explains it far better than I could:

I’d like to introduce my latest project… SpamMailBag.com. Here’s the plan:

Using domain/task specific email addresses, I will be signing up for various services, websites and posting on various forums. I’m also hoping to pull some favours and have some fellow bloggers do blog specific ones…. For example I will be setting up computerdefense.org@spammailbag.com. I would give other examples but that would negate the effort. All emails will automatically be posted to SpamMailBag.com.

What is the goal? Well, for me it’s simply a social project. I’m curious to see which services and websites requiring sign-ups sell your information and who they sell it to. I’m curious to see which blogs are harvested and which aren’t, I’m curious to see which forums are harvested. I may even ask users to create contacts for certain addresses in outlook and outlook express or maybe gmail or hotmail to see if those addresses end up elsewhere.

Full post: http://www.computerdefense.org/?p=72

HT has already set up my email account, so here goes: j_k9@spammailbag.com

Come on, dear bots - you know you want to pick it up and spam it!

If you want to take part in the project, simple pop over to his site, register an account, and post a comment! I’m sure he’ll be more than glad to set an account up for you

Reveal The Holes In Your Webserver With Nikto

J_K9 — Tue, 22 Aug 2006 11:15:14 +0000

Having seen the (poor) quality of the HowTo Forge tutorial on Nikto, I decided to write my own. I wanted to explain every parameter in detail, rather than just pass over them as if they were not useful.

Well, after God knows how many hours of work (I hadn’t anticipated that it would take so long!), it’s up! I posted it on TAZForum, and you can find it here. I hope you like it

However, there’s something that’s annoying me.

(more…)

Linux And Security

J_K9 — Mon, 24 Apr 2006 20:12:21 +0000

I’m sorry about my absence, but I have been extremely busy the past few days. Revising for exams, building a computer from scratch, reading quite a few documents, finding out more about a degree in Computer Science, and returning to school after a brilliant Easter. So what is this post about? Linux, and security. I have been talking to a security professional about my first article, Proposing a Compelling Linux Business Case. First of all, my article was aimed at the public sector, and so certain parts of it may seem irrational and outright wrong to a security professional. I’m hoping that one of my readers knows enough about Linux to be able to respond to him with a valuable argument, because this has reached a stage which is too complex for me to handle. Maybe you could give it a shot! Contact me via the contact form if you’re interested

(more…)

SELinux Webcast

J_K9 — Tue, 04 Apr 2006 17:16:14 +0000

This Webcast by Red Hat is an excellent introduction to SELinux - it is easy to understand, but still manages to cover the topic in a large amount of detail. It is slightly old (it talks of Fedora core 5 as being unreleased as of yet), but it is still very informative. I highly recommend you take a look at it if you are new to SELinux, because I think every Linux user should be aware of its power. Watch it here.

Peace.

Why Windows Sucks

J_K9 — Wed, 22 Feb 2006 21:36:51 +0000

Forgive me if I’m wrong, but since when does Microsoft contract sponsors to host its updates, or write them for that matter? Even if the sponsors had access to the source code (which we all know would never happen), Microsoft would never distribute a third-party patch (as everyone vulnerable to and aware of the recent WMF exploit might have discovered).

Ok, to be fair, I could talk for hours about the topic proposed by the post’s title. So, I’ll say this is just one reason why Windows sucks… you can probably work the rest out for yourself anyway.

AntiOnline Tutorials

J_K9 — Sun, 19 Feb 2006 17:32:10 +0000

I have been a member of the AntiOnline forums for over a year and a half now, and over this time I have learnt a lot about security - from the threads, tutorials, and other members. So, I thought I would share the wonderful world of AO with you! I have chosen the general security tutorials, and also the Linux-related ones.

First of all, there are the undeniably amazing video tutorials by Irongeek. You can find them all on his website - they range from a simple penetration test on a web server to using nmap.

Then there are the in-depth tutorials by thehorse13. You can find them all here. I highly recommend his nmap and hping tutorials, but they are all very informative and good reads.

Tony Bradley - editor of the Internet/Network Security section on About.com - also has a good set of introductions to the background info on vulnerability scanning, firewalls, Intrusion Detection Systems, sniffers and the like. The rest of his tutorials are aimed at Windows XP users, but the mentioned ones are universal. Click here to see them.

Finally, the King of Operating Systems, gore himself. You’ll find tons of tutorials on installing different flavours of Linux, and also some security tutorials for SUSE. If you are ever having trouble, you might want to check out his tutorial list - chances are that the solution is in one of them.

There is a plethora of other great information in the Security Tutorials and Other Tutorials forums, and I cannot name all the members, but some more are: Tiger Shark, Ennis, catch, and Soda Popinsky. Why not become a member yourself to learn more?

Nmap 4.00 Released

J_K9 — Sun, 05 Feb 2006 17:16:26 +0000

I am finally able to post here! Anyway, it is with great pleasure that I (re-)announce the release of nmap 4.00! I have tested it and it is not only faster than its predecessor, but also has more accurate OS detection. Here is part of Fyodor’s interview on this new release:

You just released Nmap 4.00 after two years of work since 3.50. What are the most exciting changes?

Fyodor: Well, the Changelog shows more than 230 improvements since that release, so it is hard to choose just a few favorites. But some really do stand out. The port scanning engine has been rewritten to be much faster and (after the “diet Nmap” project) more memory efficient. The low-level packet sending subsystem has changed dramatically as well. Nmap can now send and route raw Ethernet frames rather than rely on the host’s raw sockets implementation. This is critical for Windows, since Microsoft disabled raw sockets as of Windows XP SP2. And all platforms benefit from the new ARP scanning and MAC address spoofing functionality that this change allows.

Nmap 4.0 has new, better organized and more comprehensive documentation, including a rewritten man page available in seven languages. Huge improvements have also been made in version detection, which offers many new features and saw its signature database triple in size.

Many Nmap users pick runtime interaction as their favorite new feature. If you find yourself staring at the screen wondering when Nmap will finish, just press [enter] for an estimate. If you forgot to enable verbose mode, press ‘v’ to enable it. Or press ‘V’ to turn it off. Packet tracing and debugging can be enabled or disabled on a whim as well.