Installation Docker In progress ... Manually using dpkg It is assumed that you have a clean Ubuntu Server 22.04 (https://ubuntu.com/download/server) and account with the username "user". The app will install to /home/user/dc-sonar. The next releases maybe will have a more flexible installation. Download dc_sonar_NNNN.N.NN-N_amd64.tar.gz from the last distributive (https://github.com/ST1LLY/dc-sonar/releases) to the server. Create a folder for extracting files: mkdir dc_sonar_NNNN.N.NN-N_amd64 Extract the downloaded archive: tar -xvf dc_sonar_NNNN.N.NN-N_amd64.tar.gz -C dc_sonar_NNNN.N.NN-N_amd64 Go to the folder with the extracted files: cd dc_sonar_NNNN.N.NN-N_amd64/ Install PostgreSQL: sudo bash install_postgresql.sh Install RabbitMQ: sudo bash install_rabbitmq.sh Install dependencies: sudo bash install_dependencies.sh It will ask for confirmation of adding the ppa:deadsnakes/ppa repository. Press Enter. Install dc-sonar itself: sudo dpkg -i dc_sonar_NNNN.N.NN-N_amd64.deb It will ask for information for creating a Django admin user. Provide username, mail and password. It will ask for information for creating a self-signed SSL certificate twice. Provide required information. Open: https://localhost (https://localhost/) Enter Django admin user credentials (https://www.kitploit.com/search/label/Credentials) set during the installation process before. Style guide See the information in STYLE_GUIDE.md (https://github.com/ST1LLY/dc-sonar/blob/main/STYLE_GUIDE.md) Deployment for development Docker In progress ... Manually using Windows host and Ubuntu Server guest In this case, we will set up the environment for editing code on the Windows host while running Python code on the Ubuntu guest. Set up the virtual machine Create (https://www.virtualbox.org/manual/ch01.html#gui-createvm) a virtual machine (https://www.kitploit.com/search/label/Virtual%20Machine) with 2 CPU, 2048 MB RAM, 10GB SSD using Ubuntu Server 22.04 (https://ubuntu.com/download/server) iso in VirtualBox (https://www.virtualbox.org/wiki/Downloads). If Ubuntu installer asks for updating ubuntu installer before VM's installation - agree. Choose to install OpenSSH Server. VirtualBox Port Forwarding (https://www.kitploit.com/search/label/Port%20Forwarding) Rules: Name Protocol Host IP Host Port Guest IP Guest Port SSH TCP 127.0.0.1 2222 10.0.2.15 22 RabbitMQ management console TCP 127.0.0.1 15672 10.0.2.15 15672 Django Server TCP 127.0.0.1 8000 10.0.2.15 8000 NTLM Scrutinizer TCP 127.0.0.1 5000 10.0.2.15 5000 PostgreSQL TCP 127.0.0.1 25432 10.0.2.15 5432 Config Window Download (https://www.python.org/downloads/release/python-3105/) and install Python 3.10.5. Create a folder for the DC Sonar project. Go to the project folder using Git for Windows (https://git-scm.com/download/win): cd '{PATH_TO_FOLDER}' Make Windows installation steps for dc-sonar-user-layer (https://github.com/ST1LLY/dc-sonar-user-layer#windows). Make Windows installation steps for dc-sonar-workers-layer (https://github.com/ST1LLY/dc-sonar-workers-layer#windows). Make Windows installation steps for ntlm-scrutinizer (https://github.com/ST1LLY/ntlm-scrutinizer#windows). Make Windows installation steps for dc-sonar-frontend (https://github.com/ST1LLY/dc-sonar-frontend#windows). Set shared folders Make steps (https://gist.github.com/estorgio/0c76e29c0439e683caca694f338d4003#initial-steps) from "Open VirtualBox" to "Reboot VM", but add shared folders to VM VirtualBox with "Auto-mount", like in the picture below:
Shall the new role be allowed to create more new roles? (y/n) n Create the dc_sonar_user_layer database account: sudo -u postgres createuser --interactive Output:
Enter name of role to add: dc_sonar_user_layer
Shall the new role be a superuser? (y/n) n
Shall the new role be allowed to create databases? (y/n) n
Shall the new role be allowed to create more new roles? (y/n) n Create the back_workers_db database: sudo -u postgres createdb back_workers_db Create the web_app_db database: sudo -u postgres createdb web_app_db Run the psql: sudo -u postgres psql Set a password for the admin account: ALTER USER admin WITH PASSWORD '{YOUR_PASSWORD}';
Set a password for the dc_sonar_workers_layer account: ALTER USER dc_sonar_workers_layer WITH PASSWORD '{YOUR_PASSWORD}';
Set a password for the dc_sonar_user_layer account: ALTER USER dc_sonar_user_layer WITH PASSWORD '{YOUR_PASSWORD}';
Grant CRUD permissions for the dc_sonar_workers_layer account on the back_workers_db database: \c back_workers_db
GRANT CONNECT ON DATABASE back_workers_db to dc_sonar_workers_layer;
GRANT USAGE ON SCHEMA public to dc_sonar_workers_layer;
GRANT ALL ON ALL TABLES IN SCHEMA public TO dc_sonar_workers_layer;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO dc_sonar_workers_layer;
GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO dc_sonar_workers_layer;
Grant CRUD permissions for the dc_sonar_user_layer account on the web_app_db database: \c web_app_db
GRANT CONNECT ON DATABASE web_app_db to dc_sonar_user_layer;
GRANT USAGE ON SCHEMA public to dc_sonar_user_layer;
GRANT ALL ON ALL TABLES IN SCHEMA public TO dc_sonar_user_layer;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO dc_sonar_user_layer;
GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO dc_sonar_user_layer;
Exit of the psql: \q
Open the pg_hba.conf file: sudo nano /etc/postgresql/12/main/pg_hba.conf Add the line for the connection to allow the connection from the host machine to PostgreSQL, save changes and close the file: # IPv4 local connections:
host all all 127.0.0.1/32 md5
host all admin 0.0.0.0/0 md5
Open the postgresql.conf file: sudo nano /etc/postgresql/12/main/postgresql.conf
Change specified below params, save changes and close the file: listen_addresses = 'localhost,10.0.2.15'
shared_buffers = 512MB
work_mem = 5MB
maintenance_work_mem = 100MB
effective_cache_size = 1GB
Restart the PostgreSQL service: sudo service postgresql restart Check the PostgreSQL service status: service postgresql status Check the log file if it is needed: tail -f /var/log/postgresql/postgresql-12-main.log Now you can connect to created databases using admin account and client such as DBeaver (https://dbeaver.io/download/) from Windows. Config RabbitMQ Install RabbitMQ using the script (https://www.rabbitmq.com/install-debian.html#apt-quick-start-packagecloud). Enable the management plugin: sudo rabbitmq-plugins enable rabbitmq_management Create the RabbitMQ admin account: sudo rabbitmqctl add_user admin {YOUR_PASSWORD} Tag the created user for full management UI and HTTP API access: sudo rabbitmqctl set_user_tags admin administrator Open management UI on http://localhost:15672/. Install Python3.10 Ensure that your system is updated and the required packages installed: sudo apt update && sudo apt upgrade -y Install the required dependency for adding custom PPAs: sudo apt install software-properties-common -y Then proceed and add the deadsnakes PPA to the APT package manager sources list as below: sudo add-apt-repository ppa:deadsnakes/ppa Download Python 3.10: sudo apt install python3.10=3.10.5-1+focal1 Install the dependencies: sudo apt install python3.10-dev=3.10.5-1+focal1 libpq-dev=12.11-0ubuntu0.20.04.1 libsasl2-dev libldap2-dev libssl-dev Install the venv module: sudo apt-get install python3.10-venv Check the version of installed python: python3.10 --version
Output:
Enter name of role to add: dc_sonar_user_layer
Shall the new role be a superuser? (y/n) n
Shall the new role be allowed to create databases? (y/n) n
Shall the new role be allowed to create more new roles? (y/n) n Create the back_workers_db database: sudo -u postgres createdb back_workers_db Create the web_app_db database: sudo -u postgres createdb web_app_db Run the psql: sudo -u postgres psql Set a password for the admin account: ALTER USER admin WITH PASSWORD '{YOUR_PASSWORD}';
Set a password for the dc_sonar_workers_layer account: ALTER USER dc_sonar_workers_layer WITH PASSWORD '{YOUR_PASSWORD}';
Set a password for the dc_sonar_user_layer account: ALTER USER dc_sonar_user_layer WITH PASSWORD '{YOUR_PASSWORD}';
Grant CRUD permissions for the dc_sonar_workers_layer account on the back_workers_db database: \c back_workers_db
GRANT CONNECT ON DATABASE back_workers_db to dc_sonar_workers_layer;
GRANT USAGE ON SCHEMA public to dc_sonar_workers_layer;
GRANT ALL ON ALL TABLES IN SCHEMA public TO dc_sonar_workers_layer;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO dc_sonar_workers_layer;
GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO dc_sonar_workers_layer;
Grant CRUD permissions for the dc_sonar_user_layer account on the web_app_db database: \c web_app_db
GRANT CONNECT ON DATABASE web_app_db to dc_sonar_user_layer;
GRANT USAGE ON SCHEMA public to dc_sonar_user_layer;
GRANT ALL ON ALL TABLES IN SCHEMA public TO dc_sonar_user_layer;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO dc_sonar_user_layer;
GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO dc_sonar_user_layer;
Exit of the psql: \q
Open the pg_hba.conf file: sudo nano /etc/postgresql/12/main/pg_hba.conf Add the line for the connection to allow the connection from the host machine to PostgreSQL, save changes and close the file: # IPv4 local connections:
host all all 127.0.0.1/32 md5
host all admin 0.0.0.0/0 md5
Open the postgresql.conf file: sudo nano /etc/postgresql/12/main/postgresql.conf
Change specified below params, save changes and close the file: listen_addresses = 'localhost,10.0.2.15'
shared_buffers = 512MB
work_mem = 5MB
maintenance_work_mem = 100MB
effective_cache_size = 1GB
Restart the PostgreSQL service: sudo service postgresql restart Check the PostgreSQL service status: service postgresql status Check the log file if it is needed: tail -f /var/log/postgresql/postgresql-12-main.log Now you can connect to created databases using admin account and client such as DBeaver (https://dbeaver.io/download/) from Windows. Config RabbitMQ Install RabbitMQ using the script (https://www.rabbitmq.com/install-debian.html#apt-quick-start-packagecloud). Enable the management plugin: sudo rabbitmq-plugins enable rabbitmq_management Create the RabbitMQ admin account: sudo rabbitmqctl add_user admin {YOUR_PASSWORD} Tag the created user for full management UI and HTTP API access: sudo rabbitmqctl set_user_tags admin administrator Open management UI on http://localhost:15672/. Install Python3.10 Ensure that your system is updated and the required packages installed: sudo apt update && sudo apt upgrade -y Install the required dependency for adding custom PPAs: sudo apt install software-properties-common -y Then proceed and add the deadsnakes PPA to the APT package manager sources list as below: sudo add-apt-repository ppa:deadsnakes/ppa Download Python 3.10: sudo apt install python3.10=3.10.5-1+focal1 Install the dependencies: sudo apt install python3.10-dev=3.10.5-1+focal1 libpq-dev=12.11-0ubuntu0.20.04.1 libsasl2-dev libldap2-dev libssl-dev Install the venv module: sudo apt-get install python3.10-venv Check the version of installed python: python3.10 --version
Output:
Python 3.10.5 Hosts Add IP addresses of Domain Controllers to /etc/hosts sudo nano /etc/hosts
Layers Set venv We have to create venv on a level above as VM VirtualBox doesn't allow us to make it in shared folders. Go to the home directory where shared folders located: cd /home/user Make deploy steps (https://github.com/ST1LLY/dc-sonar-user-layer#ubuntu) for dc-sonar-user-layer on Ubuntu. Make deploy steps (https://github.com/ST1LLY/dc-sonar-workers-layer#ubuntu) for dc-sonar-workers-layer on Ubuntu. Make deploy steps (https://github.com/ST1LLY/ntlm-scrutinizer#preparations-for-run) for ntlm-scrutinizer on Ubuntu. Config modules Make config steps (https://github.com/ST1LLY/dc-sonar-user-layer#config) for dc-sonar-user-layer on Ubuntu. Make config steps (https://github.com/ST1LLY/dc-sonar-workers-layer#ubuntu) for dc-sonar-workers-layer on Ubuntu. Make config steps (https://github.com/ST1LLY/ntlm-scrutinizer#preparations-for-run) for ntlm-scrutinizer on Ubuntu. Run Make run steps (https://github.com/ST1LLY/ntlm-scrutinizer#run) for ntlm-scrutinizer on Ubuntu. Make run steps (https://github.com/ST1LLY/dc-sonar-user-layer#run) for dc-sonar-user-layer on Ubuntu. Make run steps (https://github.com/ST1LLY/dc-sonar-workers-layer#run) for dc-sonar-workers-layer on Ubuntu. Make run steps (https://github.com/ST1LLY/dc-sonar-frontend#run-development) for dc-sonar-frontend on Windows. Open https://localhost:8000/admin/ in a browser on the Windows host and agree with the self-signed certificate. Open https://localhost:4200/ in the browser on the Windows host and login as created Django user.
Download Dc-Sonar (https://github.com/ST1LLY/dc-sonar)
Layers Set venv We have to create venv on a level above as VM VirtualBox doesn't allow us to make it in shared folders. Go to the home directory where shared folders located: cd /home/user Make deploy steps (https://github.com/ST1LLY/dc-sonar-user-layer#ubuntu) for dc-sonar-user-layer on Ubuntu. Make deploy steps (https://github.com/ST1LLY/dc-sonar-workers-layer#ubuntu) for dc-sonar-workers-layer on Ubuntu. Make deploy steps (https://github.com/ST1LLY/ntlm-scrutinizer#preparations-for-run) for ntlm-scrutinizer on Ubuntu. Config modules Make config steps (https://github.com/ST1LLY/dc-sonar-user-layer#config) for dc-sonar-user-layer on Ubuntu. Make config steps (https://github.com/ST1LLY/dc-sonar-workers-layer#ubuntu) for dc-sonar-workers-layer on Ubuntu. Make config steps (https://github.com/ST1LLY/ntlm-scrutinizer#preparations-for-run) for ntlm-scrutinizer on Ubuntu. Run Make run steps (https://github.com/ST1LLY/ntlm-scrutinizer#run) for ntlm-scrutinizer on Ubuntu. Make run steps (https://github.com/ST1LLY/dc-sonar-user-layer#run) for dc-sonar-user-layer on Ubuntu. Make run steps (https://github.com/ST1LLY/dc-sonar-workers-layer#run) for dc-sonar-workers-layer on Ubuntu. Make run steps (https://github.com/ST1LLY/dc-sonar-frontend#run-development) for dc-sonar-frontend on Windows. Open https://localhost:8000/admin/ in a browser on the Windows host and agree with the self-signed certificate. Open https://localhost:4200/ in the browser on the Windows host and login as created Django user.
Download Dc-Sonar (https://github.com/ST1LLY/dc-sonar)
DevOps stuff important?
https://www.reddit.com/r/Pentesting/comments/10kvrvw/devops_stuff_important/
<!-- SC_OFF -->As the title suggest, I want to know if its worth my time learning some devops as an aspiring pentester. Maybe learn the basics, but I really want to get hands on the security related stuff ASAP and dont want to spend a lot of time getting deep knowledge of docker, kubernetes, aws ..... Is this a good idea? Edit: Havent mentioned it but I already have experience with linux, networking, programming... basic system administrator skills. So Im not starting at 0. I know I will start a career in cybersec for sure, I just want to know if I should learn a bit of devops first <!-- SC_ON --> submitted by /u/elfauno6 (https://www.reddit.com/user/elfauno6)
[link] (https://www.reddit.com/r/Pentesting/comments/10kvrvw/devops_stuff_important/) [comments] (https://www.reddit.com/r/Pentesting/comments/10kvrvw/devops_stuff_important/)
https://www.reddit.com/r/Pentesting/comments/10kvrvw/devops_stuff_important/
<!-- SC_OFF -->As the title suggest, I want to know if its worth my time learning some devops as an aspiring pentester. Maybe learn the basics, but I really want to get hands on the security related stuff ASAP and dont want to spend a lot of time getting deep knowledge of docker, kubernetes, aws ..... Is this a good idea? Edit: Havent mentioned it but I already have experience with linux, networking, programming... basic system administrator skills. So Im not starting at 0. I know I will start a career in cybersec for sure, I just want to know if I should learn a bit of devops first <!-- SC_ON --> submitted by /u/elfauno6 (https://www.reddit.com/user/elfauno6)
[link] (https://www.reddit.com/r/Pentesting/comments/10kvrvw/devops_stuff_important/) [comments] (https://www.reddit.com/r/Pentesting/comments/10kvrvw/devops_stuff_important/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Story of Stored HTML Injection
https://medium.com/@althafaluvi29/story-of-stored-html-injection-7e04e4a52916?source=rss------bug_bounty-5
https://medium.com/@althafaluvi29/story-of-stored-html-injection-7e04e4a52916?source=rss------bug_bounty-5
Whoami: AlthafContinue reading on Medium » (https://medium.com/@althafaluvi29/story-of-stored-html-injection-7e04e4a52916?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Understanding Port Forwarding
https://cdn-images-1.medium.com/max/600/0*H-7o9L3cslczp5mM.jpg
What is Port forwarding ? and What Does it do?
Continue reading on Medium »
Understanding Port Forwarding
https://cdn-images-1.medium.com/max/600/0*H-7o9L3cslczp5mM.jpg
What is Port forwarding ? and What Does it do?
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
These Princeton SIM Swap study results will terrify you.
https://cdn-images-1.medium.com/max/2600/1*I5cfGM7n7kMkU2mhlMNlfw.jpeg
In an article titled “An Empirical Study of Wireless Carrier Authentication for SIM Swaps” researchers from Princeton University, discuss…
Continue reading on Medium »
These Princeton SIM Swap study results will terrify you.
https://cdn-images-1.medium.com/max/2600/1*I5cfGM7n7kMkU2mhlMNlfw.jpeg
In an article titled “An Empirical Study of Wireless Carrier Authentication for SIM Swaps” researchers from Princeton University, discuss…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
The Most Common Types Of Scams To Avoid
In this article, I will be telling you the most common types of scams to avoid which is hacking, Hacking is a scam that is fast spreading…
Continue reading on Medium »
The Most Common Types Of Scams To Avoid
In this article, I will be telling you the most common types of scams to avoid which is hacking, Hacking is a scam that is fast spreading…
Continue reading on Medium »