wiki.secureit.in

Main Page

From SecureIT Wiki

Jump to: navigation, search

Welcome to SecureIT Wiki

One Source to get all unique information about Linux and Security. Here we have tried to provide the documents about Linux,Information Security,Cisco Devices security and Other security related products which are rarely available or expired. Documentation on Firewall, IDS, Sniffer, HIDS, Web Servers, Security certificates, Security Books, Hacking, Various Linux Distribution, Linux Commands, tools, tips etc. For Windows, we have only security related documents.

Anti Virus

ClamAV, Avast(Win), SpywareTerminator(Win)

IDS / IPS / HIPS

Ossec

VPN / Encryption

OpenVPN,

Firewall

Pix, Firestarter

Network Monitoring / Sniffer / Packet Analyzer / Packet Sniffer

Ntop, nmap, Bigboos, Nessus, p0f, ehnt

Simulators / NetSim

Dynamips/dynagen

Linux Servers Distributions

Linux Security Distributions

Adios, backtrack, ophcrack

Scripts

Netflow Analyzer in Perl using ehnt Packet Sniffer in Perl Syslog Server in Perl

Secure Server Implementation

Postfix + LDAP + Dovecot + SquirellMail + ClamAV + MailScanner + SpamAssassin Postfix + Dovecot + SquirellMail + ClamAV + MailScanner + SpamAssassin (Without Ldap)

Books

PDF/CHM Links

Your contribution is valuable , kindly provide the documents at wiki@secureit.in

Cacti & iptables

#!/usr/bin/perl # # This is a quick perl script to  # pull bandwidth usage from iptables chains # # If you use/optimize this script, please let me know. # Brian Stanback : brian [at] stanback [dot] net  # Example iptables rule for web bandwidth usage: # > iptables -N WWW # > iptables -A WWW -j ACCEPT # > iptables -A INPUT -p tcp -m tcp --dport 80 -j WWW # > iptables -A OUTPUT -p tcp -m tcp --sport 80 -j WWW # # Run "iptables.pl WWW" as root to test, note that you can  # combine more than one protocol into a single chain. # # Sudo Configuration (/etc/sudoers) # > www-data    ALL = NOPASSWD: /usr/share/cacti/scripts/iptables.pl # # The Input String should be set to "sudo <path_cacti>/scripts/iptables.pl <chain>" # and you will need to setup an input field so that the <chain> argument can be passwd. # # The data input type should be set to COUNTER #  if ($ARGV[0]) {         $chains = `/sbin/iptables -xnvL | grep -A 2 'Chain $ARGV[0]'`;         @chains = split(/\n/, $chains);         $chains[2] =~ /[\W+]?[0-9]+\W+([0-9]+)\W+/;         print $1; } else {         print "Usage: $0 Chain\n"; } 

http://rodotelmi.rebstech.com/2008/06/30/cacti-with-iptablesipfw-traffic-monitoring/

Ossec - What Exactly it is

Ossec - Open Source Host Intrusion Detection System

Hiding the apache Identity

To hide the version and other information of apache server which can be
retrieved through header of an request,
put the following lines in your apache httpd.conf file.

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
ServerSignature off
ServerTokens Prod

Through these lines you are hiding the signature of apache and the
header will only display 'Apache'.

How to Block Torrent in Network

Torrent works based on the seeds and peers (the other computer which connects to your client application to send or receive the files) .

The seeds and peers  information to your client is provided by the torrent tracker server, which is mentioned in the  .torrent file downloaded by you from some torrent site.

Your Torrent client will read the .torrent file and connect with the torrent tracker server on 6881-7000/tcp or 2710/tcp port through http protocol and torrent tracker server will provide all the other client computer which are currently connected and having the full file or partial file which yuo want to download.

Than your client application(torrent client) will connect to those other client machines(torrent client applications) and starting transferring the data.

To block the torrent in your network , you can take the following two actions.

1. Do not allow "NEW" incoming packets in your network.

2. Block 6881-7000/tcp and 2710/tcp ports for outgoing so that your client application(torrent client) could not  connect the tracker server and get the information about other systems.

If your client(torrent application) will not get the information about other systems in world , it will not be able to download the files.

This is want you want to do.....

Cheer Up !!

Your comments and experience are most welcome.

Cacti Password Hacking

I have found one password hacking trick which can be used for cacti to
change any user password including admin.

http://xxx.xxx.xxx.xxx/auth_changepassword.php?ref=index.php&action=changepassword&username=admin&password=aaaaaa&confirm=aaaaaa&submit=Save

xxx.xxx.xxx.xxx - ip of cacti server.

This url will provide option to change the password of admin user. if
the same is happening with your cacti also kindly block
auth_changepassword.php file from accessing through web.

BIOS Blaster and Capture Utilities

 11th Alliance toolkit  =>    Another toolkit containing utilities needed to gain access to a wide range  of BIOS passwords. Download it from  http://www.wheres.com/etc/FatherQuinn/bios310.zip.
 AMIDECOD    =>        This utility will decode BIOS passwords on American Megatrends systems. Get it at http://www.outpost9.com/files/crackers.html.
 AMI Password Viewer   =>      This utility from KORT reads, decrypts, and displays AMI BIOS passwords. Get it at http://www.rat.pp.se/hotel/panik/archive/skw-ami.zip.
  AW.COM     =>   This utility by Falcon n Alex cracks Award BIOS passwords. Get it at http://www.lls.se/~oscar/files/pwd/aw.zip.
  CmosPwd     =>  CmosPwd can retrieve BIOS passwords from many popular computers,including IBM, Compaq, Packard Bell, and Gateway. Download it at   http://www.esiea.fr/public_html/Christophe.GRENIER/index.html?cmospwd.html.
  Kill CMOS   => If a user-defined password already exists on a computer, resetting the CMOS to its default state will erase that password. A utility to do this can be downloaded from http://www.AntiOnline.com/archives/anticode/bios-crackers/killcmos.zip.