Forwarded from UNDERCODE NEWS
Forwarded from UNDERCODE NEWS
The $2.1 billion purchase of Fitbit by Google is eventually complete: set sail again.
#International
#International
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦π§ How to monitor packets passing through the firewall?
1) Configure rsyslog to use the log file /var/log/firewall_trace.log for firewall tracing.
$ cat << EOF | sudo tee /etc/rsyslog.d/01-firewall_trace.conf
# Log messages generated by iptables firewall to file
if \ $ syslogfacility-text == 'kern' and \ $ msg contains 'TRACE' then /var/log/firewall_trace.log
# stop processing it further
& stop
EOF
2) Apply rsyslog configuration.
$ sudo systemctl restart rsyslog
Rotate the log file to save disk space.
$ cat << EOF | sudo tee /etc/logrotate.d/firewall_trace.conf
/var/log/firewall_trace.log
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate> / dev / null
endscript
}
EOF
3) You should be sure to rate these logs hourly by size, or transfer them to an external logging service, which I highly recommend.
How to track incoming packages
Use raw and PREROUTING to monitor packets coming in on any network interface.
$ sudo iptables -t raw -A PREROUTING -p tcp --destination 1.2.3.4 --dport 443 -j TRACE
Let's see the raw table
$ sudo iptables -t raw -L -v -n --line-numbers
Chain PREROUTING (policy ACCEPT 3501 packets, 946K bytes)
num pkts bytes target prot opt ββin out source destination
1 468 28159 TRACE tcp - * * 0.0.0.0/0 1.2.3.4 tcp dpt: 443
Chain OUTPUT (policy ACCEPT 885 packets, 695K bytes)
num pkts bytes target prot opt ββin out source destination
The trail to the internal network will look like this.
[...]
Jul 18 18:33:27 cerberus kernel: [68907.892027] TRACE: raw: PREROUTING: policy: 2 IN = eth0 OUT = MAC = 00: 15: 17: c3: a1: aa: 00: 15: 17: c3: fb : 07: 01: 00 SRC = 172.69.63.16 DST = 1.2.3.4 LEN = 40 TOS = 0x00 PREC = 0x00 TTL = 56 ID = 64783 DF PROTO = TCP SPT = 62598 DPT = 443 SEQ = 234589096 ACK = 404477568 WINDOW = 82 RES = 0x00 ACK URGP = 0
Jul 18 18:33:27 cerberus kernel: [68907.892093] TRACE: mangle: INPUT: policy: 1 IN = eth0 OUT = MAC = 00: 15: 17: c3: a1: aa: 00: 15: 17: c3: fb : 07: 01: 00 SRC = 172.69.63.16 DST = 1.2.3.4 LEN = 40 TOS = 0x00 PREC = 0x00 TTL = 56 ID = 64783 DF PROTO = TCP SPT = 62598 DPT = 443 SEQ = 234589096 ACK = 404477568 WINDOW = 82 RES = 0x00 ACK URGP = 0
Jul 18 18:33:27 cerberus kernel: [68907.892113] TRACE: filter: INPUT: rule: 6 IN = eth0 OUT = MAC = 00: 15: 17: c3: a1: aa: 00: 15: 17: c3: fb : 07: 01: 00 SRC = 172.69.63.16 DST = 1.2.3.4 LEN = 40 TOS = 0x00 PREC = 0x00 TTL = 56 ID = 64783 DF PROTO = TCP SPT = 62598 DPT = 443 SEQ = 234589096 ACK = 404477568 WINDOW = 82 RES = 0x00 ACK URGP = 0
Jul 18 18:33:27 cerberus kernel: [68907.892150] TRACE: raw: PREROUTING: policy: 2 IN = eth0 OUT = MAC = 00: 15: 17: c3: a1: aa: 00: 15: 17: c3: fb : 07: 01: 00 SRC = 172.69.63.16 DST = 1.2.3.4 LEN = 40 TOS = 0x00 PREC = 0x00 TTL = 56 ID = 64784 DF PROTO = TCP SPT = 62598 DPT = 443 SEQ = 234589096 ACK = 404477569 WINDOW = 82 RES = 0x00 ACK RST URGP = 0
[...]
Display the filyer table, INPUT chain, rule number 6, which will accept bound and established connections.
$ sudo iptables -t filter -L INPUT 6 -v -n --line-numbers
6 979K 851M ACCEPT all - * * 0.0.0.0/0 0.0.0.0/0
Remove the first rule in the raw table, the PREROUTING chain.
$ sudo iptables -t raw -D PREROUTING 1
How to track outgoing packets
Use raw table and OUTPUT to keep track of locally generated packets.
$ sudo iptables -t raw -A OUTPUT -p tcp --destination 8.8.8.8 --dport 53 -j TRACE
$ sudo iptables -t raw -A OUTPUT -p udp --destination 8.8.8.8 --dport 53 -j TRACE
Let's see the raw table
$ sudo iptables -t raw -L -v -n --line-numbers
Chain PREROUTING (policy ACCEPT 1281 packets, 422K bytes)
num pkts bytes target prot opt ββin out source destination
Chain OUTPUT (policy ACCEPT 379 packets, 324K bytes)
num pkts bytes target prot opt ββin out source destination
1 0 0 TRACE tcp - * * 0.0.0.0/0 8.8.8.8 tcp dpt: 53
2 0 0 TRACE udp - * * 0.0.0.0/0 8.8.8.8 udp d
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦π§ How to monitor packets passing through the firewall?
1) Configure rsyslog to use the log file /var/log/firewall_trace.log for firewall tracing.
$ cat << EOF | sudo tee /etc/rsyslog.d/01-firewall_trace.conf
# Log messages generated by iptables firewall to file
if \ $ syslogfacility-text == 'kern' and \ $ msg contains 'TRACE' then /var/log/firewall_trace.log
# stop processing it further
& stop
EOF
2) Apply rsyslog configuration.
$ sudo systemctl restart rsyslog
Rotate the log file to save disk space.
$ cat << EOF | sudo tee /etc/logrotate.d/firewall_trace.conf
/var/log/firewall_trace.log
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate> / dev / null
endscript
}
EOF
3) You should be sure to rate these logs hourly by size, or transfer them to an external logging service, which I highly recommend.
How to track incoming packages
Use raw and PREROUTING to monitor packets coming in on any network interface.
$ sudo iptables -t raw -A PREROUTING -p tcp --destination 1.2.3.4 --dport 443 -j TRACE
Let's see the raw table
$ sudo iptables -t raw -L -v -n --line-numbers
Chain PREROUTING (policy ACCEPT 3501 packets, 946K bytes)
num pkts bytes target prot opt ββin out source destination
1 468 28159 TRACE tcp - * * 0.0.0.0/0 1.2.3.4 tcp dpt: 443
Chain OUTPUT (policy ACCEPT 885 packets, 695K bytes)
num pkts bytes target prot opt ββin out source destination
The trail to the internal network will look like this.
[...]
Jul 18 18:33:27 cerberus kernel: [68907.892027] TRACE: raw: PREROUTING: policy: 2 IN = eth0 OUT = MAC = 00: 15: 17: c3: a1: aa: 00: 15: 17: c3: fb : 07: 01: 00 SRC = 172.69.63.16 DST = 1.2.3.4 LEN = 40 TOS = 0x00 PREC = 0x00 TTL = 56 ID = 64783 DF PROTO = TCP SPT = 62598 DPT = 443 SEQ = 234589096 ACK = 404477568 WINDOW = 82 RES = 0x00 ACK URGP = 0
Jul 18 18:33:27 cerberus kernel: [68907.892093] TRACE: mangle: INPUT: policy: 1 IN = eth0 OUT = MAC = 00: 15: 17: c3: a1: aa: 00: 15: 17: c3: fb : 07: 01: 00 SRC = 172.69.63.16 DST = 1.2.3.4 LEN = 40 TOS = 0x00 PREC = 0x00 TTL = 56 ID = 64783 DF PROTO = TCP SPT = 62598 DPT = 443 SEQ = 234589096 ACK = 404477568 WINDOW = 82 RES = 0x00 ACK URGP = 0
Jul 18 18:33:27 cerberus kernel: [68907.892113] TRACE: filter: INPUT: rule: 6 IN = eth0 OUT = MAC = 00: 15: 17: c3: a1: aa: 00: 15: 17: c3: fb : 07: 01: 00 SRC = 172.69.63.16 DST = 1.2.3.4 LEN = 40 TOS = 0x00 PREC = 0x00 TTL = 56 ID = 64783 DF PROTO = TCP SPT = 62598 DPT = 443 SEQ = 234589096 ACK = 404477568 WINDOW = 82 RES = 0x00 ACK URGP = 0
Jul 18 18:33:27 cerberus kernel: [68907.892150] TRACE: raw: PREROUTING: policy: 2 IN = eth0 OUT = MAC = 00: 15: 17: c3: a1: aa: 00: 15: 17: c3: fb : 07: 01: 00 SRC = 172.69.63.16 DST = 1.2.3.4 LEN = 40 TOS = 0x00 PREC = 0x00 TTL = 56 ID = 64784 DF PROTO = TCP SPT = 62598 DPT = 443 SEQ = 234589096 ACK = 404477569 WINDOW = 82 RES = 0x00 ACK RST URGP = 0
[...]
Display the filyer table, INPUT chain, rule number 6, which will accept bound and established connections.
$ sudo iptables -t filter -L INPUT 6 -v -n --line-numbers
6 979K 851M ACCEPT all - * * 0.0.0.0/0 0.0.0.0/0
Remove the first rule in the raw table, the PREROUTING chain.
$ sudo iptables -t raw -D PREROUTING 1
How to track outgoing packets
Use raw table and OUTPUT to keep track of locally generated packets.
$ sudo iptables -t raw -A OUTPUT -p tcp --destination 8.8.8.8 --dport 53 -j TRACE
$ sudo iptables -t raw -A OUTPUT -p udp --destination 8.8.8.8 --dport 53 -j TRACE
Let's see the raw table
$ sudo iptables -t raw -L -v -n --line-numbers
Chain PREROUTING (policy ACCEPT 1281 packets, 422K bytes)
num pkts bytes target prot opt ββin out source destination
Chain OUTPUT (policy ACCEPT 379 packets, 324K bytes)
num pkts bytes target prot opt ββin out source destination
1 0 0 TRACE tcp - * * 0.0.0.0/0 8.8.8.8 tcp dpt: 53
2 0 0 TRACE udp - * * 0.0.0.0/0 8.8.8.8 udp d
β β β Uππ»βΊπ«Δπ¬πβ β β β
Forwarded from UNDERCODE NEWS
Forwarded from UNDERCODE NEWS
The macOS beta edition of Apple started abandoning its own components to circumvent the whitelist of the firewall by default.
#Vulnerabilities
#Vulnerabilities
Forwarded from DailyCVE
π΅Vulnerabilities in input validation errors in many Cisco products:
https://dailycve.com/vulnerabilities-input-validation-errors-many-cisco-products
https://dailycve.com/vulnerabilities-input-validation-errors-many-cisco-products
Dailycve
Vulnerabilities in input validation errors in many Cisco products | CVE
Details:
The Cisco RV110W, etc. is all a US Cisco router (Cisco). There is an input validation error limitation in Cisco Small Business Routers, which derives from inadequate input validation in the site management gui. This vulnerability can be usedβ¦
Forwarded from DailyCVE
π΅Cisco Small Business Routers input validation error vulnerability:
https://dailycve.com/cisco-small-business-routers-input-validation-error-vulnerability
https://dailycve.com/cisco-small-business-routers-input-validation-error-vulnerability
Dailycve
Cisco Small Business Routers input validation error vulnerability | CVE
Details:
The Cisco RV110W, etc. is all a US Cisco router (Cisco). There is an input validation error flaw in Cisco Small Business Routers that stems from inaccurate validation of user-provided input in the site management interface. This vulnerabilityβ¦
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦why you need ssh for github ?
Connecting to GitHub with SSH
You can connect to GitHub using SSH.
About SSHβ
Using the SSH protocol, you can connect and authenticate to remote servers and services. With SSH keys, you can connect to GitHub without supplying your username and personal access token at each visit.
Checking for existing SSH keysβ
Before you generate an SSH key, you can check to see if you have any existing SSH keys.
Generating a new SSH key and adding it to the ssh-agentβ
After you've checked for existing SSH keys, you can generate a new SSH key to use for authentication, then add it to the ssh-agent.
Adding a new SSH key to your GitHub accountβ
To configure your GitHub account to use your new (or existing) SSH key, you'll also need to add it to your GitHub account.
Testing your SSH connectionβ
After you've set up your SSH key and added it to your GitHub account, you can test your connection.
Working with SSH key passphrasesβ
You can secure your SSH keys and configure an authentication agent so that you won't have to reenter your passphrase every time you use your SSH keys.
github
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦why you need ssh for github ?
Connecting to GitHub with SSH
You can connect to GitHub using SSH.
About SSHβ
Using the SSH protocol, you can connect and authenticate to remote servers and services. With SSH keys, you can connect to GitHub without supplying your username and personal access token at each visit.
Checking for existing SSH keysβ
Before you generate an SSH key, you can check to see if you have any existing SSH keys.
Generating a new SSH key and adding it to the ssh-agentβ
After you've checked for existing SSH keys, you can generate a new SSH key to use for authentication, then add it to the ssh-agent.
Adding a new SSH key to your GitHub accountβ
To configure your GitHub account to use your new (or existing) SSH key, you'll also need to add it to your GitHub account.
Testing your SSH connectionβ
After you've set up your SSH key and added it to your GitHub account, you can test your connection.
Working with SSH key passphrasesβ
You can secure your SSH keys and configure an authentication agent so that you won't have to reenter your passphrase every time you use your SSH keys.
github
β β β Uππ»βΊπ«Δπ¬πβ β β β
Forwarded from DailyCVE
π΅unpatched SQL injection vulnerability exists in EQ enterprise management system:
https://dailycve.com/unpatched-sql-injection-vulnerability-exists-eq-enterprise-management-system
https://dailycve.com/unpatched-sql-injection-vulnerability-exists-eq-enterprise-management-system
Dailycve
unpatched SQL injection vulnerability exists in EQ enterprise management system | CVE
Details:
Guangzhou Yiquan Information Technology is an Internet SAAS provider which specializes in providing small and medium enterprises with online management software.
There's a SQL injection flaw in the EQ business management system. The flaw mayβ¦
Forwarded from DailyCVE
π΅Cscms has command execution vulnerability:
https://dailycve.com/cscms-has-command-execution-vulnerability
https://dailycve.com/cscms-has-command-execution-vulnerability
Dailycve
Cscms has command execution vulnerability | CVE
Details:
Cheng's CMS-cscms is a diversified content management system that uses PHP5+MYSQL as the technical basis for development and the core operating structure is developed using OOP (object-oriented).
In order to gain control of the server, Cscmsβ¦
Forwarded from DailyCVE
π΅YKBuilder V5.1 has a binary vulnerability:
https://dailycve.com/ykbuilder-v51-has-binary-vulnerability
https://dailycve.com/ykbuilder-v51-has-binary-vulnerability
Dailycve
YKBuilder V5.1 has a binary vulnerability | CVE
Details:
YKBuilder is a platform that is suitable for embedded integrated development construction.
The binary bugs in YKBuilder V5.1 are current. This flaw can be used by attackers to build malformed files and cause the software to crash.
Affectedβ¦
Forwarded from UNDERCODE NEWS
Amazon is facing a hard situation for complaints to revoke, consumers ask regulators to investigate.
#International
#International
Forwarded from UNDERCODE NEWS
In 2021, where unseen individuals will change the world, I realized the difficulty of talking about the Internet.
#Analytiques
#Analytiques
Forwarded from UNDERCODE NEWS
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Practical PHP: Master the Basics and Code Dynamic Websites :
4.6 rating !
By the end of this course, you will have a thorough understanding of the PHP fundamentals
Upon completion, you will have coded a handful of useful dynamic PHP examples
In the last section of this course, you focus on building a dynamic website for a restaurant
By the end of this course, you will be so excited about your newly acquired PHP skills and want to start converting all your websites to PHP!
free
https://www.udemy.com/course/code-dynamic-websites/
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Practical PHP: Master the Basics and Code Dynamic Websites :
4.6 rating !
By the end of this course, you will have a thorough understanding of the PHP fundamentals
Upon completion, you will have coded a handful of useful dynamic PHP examples
In the last section of this course, you focus on building a dynamic website for a restaurant
By the end of this course, you will be so excited about your newly acquired PHP skills and want to start converting all your websites to PHP!
free
https://www.udemy.com/course/code-dynamic-websites/
β β β Uππ»βΊπ«Δπ¬πβ β β β
Udemy
Free PHP (programming language) Tutorial - Practical PHP: Master the Basics and Code Dynamic Websites
Code Your Very Own Dynamic Websites by Learning PHP Through Real-World Application & Examples - Free Course
Forwarded from DailyCVE
Dailycve
flatCore SQL injection vulnerability | CVE
Details:
Based on PHP and SQLite, flatCore is a lightweight content management system (CMS).
There's a SQL injection flaw prior to flatCore CMS 2.0.0 build 139. The flaw is triggered by the accepting of malicious user data by the software and failingβ¦
Forwarded from DailyCVE
π΅SAP 3D Visual Enterprise Viewer buffer overflow vulnerability:
https://dailycve.com/sap-3d-visual-enterprise-viewer-buffer-overflow-vulnerability
https://dailycve.com/sap-3d-visual-enterprise-viewer-buffer-overflow-vulnerability
Dailycve
SAP 3D Visual Enterprise Viewer buffer overflow vulnerability | CVE
Details:
SAP 3D Visual Business Viewer is a 3D visual viewer from Germany's SAP group. The software facilitates the publication of 2D and 3D scenes in all common desktop applications in the market, and supports separate installation of ActiveX space andβ¦
Forwarded from UNDERCODE NEWS
1,1k global public vulnerabilities have been reported and more than 5 billion documents have been leaked in 2020.
#Analytiques
#Analytiques
Forwarded from UNDERCODE NEWS
LG U+ announces that South Korea will begin the full end of 2G networks, and will close its network in June.
#Technologies
#Technologies
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2021 The all-in-one Red Team extension for Web Pentester π
F E A T U R E S :"
Dynamic Reverse Shell generator (PHP, Bash, Ruby, Python,
Perl, Netcat)
Shell Spawning (TTY Shell Spawning)
XSS Payloads
Basic SQLi payloads
Local file inclusion payloads (LFI)
Base64 Encoder / Decoder
Hash Generator (MD5, SHA1, SHA256, SHA512, SM3)
Useful Linux commands (Port Forwarding, SUID)
RSS Feed (Exploit DB, Cisco Security Advisories, CXSECURITY)
CVE Search Engine
Various method of data exfiltration and download from a remote machine
C L I C K A D D :
Β» for chrome : https://chrome.google.com/webstore/detail/hack-tools/cmbndhnoonmghfofefkcccljbkdpamhi
Β» for firefox: https://addons.mozilla.org/en-US/firefox/addon/hacktools/
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2021 The all-in-one Red Team extension for Web Pentester π
F E A T U R E S :"
Dynamic Reverse Shell generator (PHP, Bash, Ruby, Python,
Perl, Netcat)
Shell Spawning (TTY Shell Spawning)
XSS Payloads
Basic SQLi payloads
Local file inclusion payloads (LFI)
Base64 Encoder / Decoder
Hash Generator (MD5, SHA1, SHA256, SHA512, SM3)
Useful Linux commands (Port Forwarding, SUID)
RSS Feed (Exploit DB, Cisco Security Advisories, CXSECURITY)
CVE Search Engine
Various method of data exfiltration and download from a remote machine
C L I C K A D D :
Β» for chrome : https://chrome.google.com/webstore/detail/hack-tools/cmbndhnoonmghfofefkcccljbkdpamhi
Β» for firefox: https://addons.mozilla.org/en-US/firefox/addon/hacktools/
β β β Uππ»βΊπ«Δπ¬πβ β β β
Google
Hack-Tools - Chrome Web Store
The all in one Red team extension for web pentester
Forwarded from DailyCVE
π΅Unpatched Hubei Taoma Qianwei Information Technology Co., Ltd. Jinwei mobile phone mall has an arbitrary file upload vulnerability:
https://dailycve.com/unpatched-hubei-taoma-qianwei-information-technology-co-ltd-jinwei-mobile-phone-mall-has-arbitrary
https://dailycve.com/unpatched-hubei-taoma-qianwei-information-technology-co-ltd-jinwei-mobile-phone-mall-has-arbitrary
Dailycve
Unpatched Hubei Taoma Qianwei Information Technology Co., Ltd. Jinwei mobile phone mall has an arbitrary file upload vulnerabilityβ¦
Details:
Hubei Taoma Qianwei Information Technology Co., Ltd.'s business scope comprises: the design, creation, sales, technical services of computer software; system integration, development of application software, etc.
Hubei Taoma Qianwei Technologyβ¦