Tag Info

New answers tagged

0

So after a simple test of 127.0.0.1 | whoami It came up with the output "root" So essentially i could do anything if i piped it in after the IP address. For example i had a user name jason who is a normal user with no special privileges. i was able to add him to the sudoers file with echo "jason ALL=(ALL) ALL" >> /etc/sudoers After this i was ...


2

A one-liner to create a readable and relatively easy-to-remember password: cat /usr/share/dict/words|shuf -n 4|tr '\n' ' '|tr -d \' Example output: correct horse battery staple If you want a longer password, change the 4 to a higher number. For a password without spaces, add an escaped space to the end of the line: cat /usr/share/dict/words|shuf -n ...


1

Using pwgen Simplest oneliner ever: pwgen It attempts to make passwords that are easy to remember. To disable that and create more secure passwords, use the --secure or -s flag. pwgen -s Are the generated passwords too long? Too short? Just append the desired length: pwgen 9 # Or pwgen -s 9 # Or pwgen 9 -s Similar tools I just happen to know ...


0

uudigen will provide you with a UUID; remember to check which version of UUID it generates on your computer as some versions will allow someone who snoops your password to track it to your computer, which may (probably is) a security issue. You can use uuidgen -r to make sure that the ID only consists of random(ish) digits and cannot be tracked to you. ...


0

If you want a "safe" solution, one where Windows does not offer to format the disk when you try to mount it, you need to use a format that is recognized by Windows. You could install Ext4 drivers on Windows, but this will only work for those machines with these drivers installed. You could use FAT32 or NTFS for the disk, and use Encfs or Truecrypt or ...


0

For the random information to be readable, we can encode it in base64. One character in base64 has 6 bits of entropy. Thus, for 128 bits of entropy you need 22 characters (128/6=21+⅓). This leads us to the command: base64 < /dev/urandom | head -c 22 Which can be translated in English by "generate cryptographic quality random data with /dev/urandom and ...


1

I don't think you understood what Windows did when it formatted the disk. When you plugged in the external drive, Windows couldn't read the filesystem (because it's encrypted) it therefore assumed the drive had no filesystem and offered to format the drive. You selected yes. Windows then deleted everything on the drive and overwrote it with a clean NTFS ...


1

I would use apg with 16-byte seed from /dev/urandom (maximum allowed) apg -a 0 -d -m 15 -n 1 -c "`head -c16 /dev/urandom`"; echo You can chain the apg commands so you can have longer password from more entropy.


1

If the command shell is running as root and User supplied input is not properly validated then it will execute whatever command you will pass to the shell. I think there will be proper validation of the inputs passed by the users. Like when a user will enter the IPv4 address then it will be combination of integers and dots and for IPv6 it will be integer ...


-1

please correct me if i'm wrong. ok. I have logged into a web server as admin through the Login page in browser. no, you havent. you have logged into a web-application onto this webserver. it essentially will ping any ip address that you input. (tested with local and external URL's) IPs. you tested IPs, not URLs with "ping" I know for ...


1

Another option is to look at truecrypt's successors, like Veracrypt (https://veracrypt.codeplex.com/). They use Truecrypt as a base but claim to add some additional security improvements. Of course since they're new it still remains to be seen whether these projects will be able to support themselves in the long term and whether they'll remain secure, so ...


26

It depends on what you mean by "readable". If you want to use only hexadecimal characters, you will need 32 of them to reach 128 bits of entropy; this line will work (using only commands from the coreutils package): head -c16 /dev/urandom | md5sum This variant produces passwords with only lowercase letters, from 'a' to 'p' (this is what you will want if ...


11

Some fab suggestions in the other answers. I find that makepasswd is not available everywhere, and using tr is (slightly) tricky, so there's another option using OpenSSL: openssl rand -base64 16 The number is the number of bytes of randomness - so 16 bytes for 128-bits of entropy.


1

You can use dm-crypt drives, which have windows support as documented here: http://superuser.com/questions/584883/how-can-i-access-volumes-encrypted-with-luks-dm-crypt-from-windows


3

There is a package called makepasswd which can do this. $ makepasswd --chars 64


6

Depending on the type of characters you may include, an easy command to create a readable password with 128 bits of entropy looks like this: < /dev/urandom tr -dc '!#$%&()*+,-./0-9:;<=>?@A-Z[\]^_`a-z{|}~"'"'" | head -c${1:-20};echo; (Taken from here) Explanation: 128 bits are equivalent to 3.40e+38 combinations. If you're using the 94 ...


3

Statistical tests like the one you use cannot detect whether /dev/urandom is good or bad on a specific machine. Specifically, /dev/urandom runs a cryptographically secure PRNG. From a given initial internal state (the "seed"), it produces an arbitrarily long stream of seemingly random bytes. The PRNG being cryptographically secure means that for an attacker ...


2

Its possible to make changes to the TCP/IP SSL levels, but not really considered a policy per say, You might be able to use a deployment service to make the changes using AutoIT (I make company wide changes with this as my deployment asset.


1

If you implement SSL-proxying, you can configure your proxy server (e.g. Squid) to not use SSLv3 to any side of the connection (client-to-proxy and proxy-to-web).


2

UEFI secure boot ensures that the UEFI firmware loads and executes only signed UEFI applications (including bootloaders) and drivers. So an attempt to modify them by introducing a malware would be detected and rejected. A vulnerability or malware (including rootkits) could possibly be also signed in the loaded code or the components loaded next. Can a ...


0

There's apparently a remover hosted by the author of jRAT at https://github.com/redpois0n/. I recommend reading the sources and cleaning up yourself rather than running untrusted code though :-) No idea. It could be that it redefined your ls function, but you would normally require a reload of the environment to have the new ls taken into account. Was that ...


4

The text segment is not typically randomized in ASLR implementations, and this is why Return-Oriented Programming (ROP) chains work. The idea is that the application's own code should be 'safe', so randomizing this memory space would be a waste of resources. ROP chains are about building a malicious payload using the application's own functionality. A ...


0

Ubuntu is Debian based so this post might be relevant. Also I believe the default program for Debian is LUKS I believe you have an option of which algorithms to use. I believe RC4/AES with SHA256 is standard. How to re-encrypt disk with different password (standard Debian) How secure is LUKS? | A look at LUKS disk ecnryption Yes the entire drive is ...


1

One way to do this is open the server up in your browser like so: https://[smtp server]:[port]. Then save the certificate that your browser encounters. For instance, https://smtp.gmail.com:465/ To do this quickly, I used Internet Explorer. To do this in a real browser you will need to override port "protection", as apparently internet users are toddlers to ...


0

Increasing the kernel's entropy counter requires the RNDADDENTROPY ioctl. The easiest way to call it is to use the rngd daemon from the rng-tools package: rngd -r /path/to/F (Note: rngd expected this to be a hardware device, so when it reaches the end of the file, it will complain that the entropy source is no longer working.)


6

First of all, to answer your question directly: This cannot be done. It is purposefully not allowed. You can, in fact write to /dev/random and it will mix your input into the random pool, potentially improving the quality of the output. But it won't update the entropy_count and unlock /dev/random for reading, because that would be cheating. Otherwise you'd ...


1

Given everything you said, you should probably read directly from your file instead of from /dev/random. As you apparently don't trust how /dev/random works (perhaps you read this paper) then be declarative, and don't place your trust in it. You should realize by now that there should be no way anyone can be allowed to inject data directly into the entropy ...


0

On most Linux systems, the entropy pool used by /dev/random is initialized at boot using /var/run/random-seed. If this process were omitted, then two identical servers using the same distribution of Linux may have an identical boot sequence and would therefore have an identical /dev/random state. To prevent this from happening, upon shutdown the current ...


1

Short version : there is no central / unique command to check this by default on linux .. but you could rely on several tools, depending on the kind of scanning that you would like to find : Fail2ban to parse log file (ssh server, web server, ftp, vpn, etc.) in order to find any brute force / irregular login attempt (and trigger some firewall rules) On ...


-1

I enjoy black arch even thought there is alot of work involved because i have installed arch linux first and have a working everything computer that provides me all that i need to help with all the reporting and what inot i need for pentest.... black arch is just a repo for me so i like that.


1

I will assume that since it is a laptop, it will exposed to external threats as you will take it with you, but you are interested in security and hardening of the system to prevent unauthorized access. VMs are a great way to sandbox your activities without putting your entire machine at risk. You can take a snapshot of the VM's configuration at anytime you ...


1

KASLR has gotten under heavy critic on the day it was released for Linux, and it has also been defeated on that very day. Spender at grSecurity has written a post about it (along with LWN comments) which I'll only summarize in a simplistic way. I highly encourage reading the original source. Address Space Layout Randomisation was originally applied to ...


1

KASLR is simply ASLR... applied to kernel space. Without KASLR the address space of the kernel is static. Any exploits using a kernel vulnerability will find it trivial to overwrite and control return addresses and the like, just like any exploit against a userspace vulnerability will find those tasks trivial without ASLR enabled. LWN has a nice article ...


1

Accept the first USB HID Keyboard/Mouse, prompt on screen to accept more USB HID Keyboards/Mice. Probably the simplest way, I don't know of any OS or software which has implemented something like that yet. Alternatively, display something onscreen that the user has to enter from the keyboard so that you know its not a rogue device. Like, a short sequence of ...


3

Nuke it from orbit. It's the only way to be sure. Seriously, if you're certain your server has been compromised, the only certain way to clean it up is to wipe it clean and rebuild, this time making sure that whatever vulnerability was used isn't present. Sure, you could spend time playing whack-a-mole, but how can you be sure that you've removed a file, ...


5

If you want to stay safe you can just ensure your Linux home and root partition are encrypted and use UEFI to ensure your Linux kernel isn't modified. Then it will be impossible for your Windows box to touch the rest of the OS. A less elegant (and insufficient from a legal standpoint if you need to guarantee the data is well protected) but maybe easier ...


0

In MySQL: SET GLOBAL general_log = 'ON'; With following Query you can check, where the data is logged, and if the logging is enabled: SHOW VARIABLES LIKE '%general_log%';


1

Ok, I figured it out. Since the application send local query to local database, in order to capture these queries I should capture lo packets with tcpdump: # tcpdump -xx -i lo This works perfectly.


0

You can use Jet Profiler for catch your querys and is a cross-platform program and you can download a free version.


8

Your question contains a category error. BSD sockets aren't a thing. They are an API to the kernel, comprised of a set of system calls. In theory, the code in the kernel, like all other code in the kernel, could have a security bug. However, the statement about 1983 does not reflect actual history. The only thing that dates from 1983 is the specification. ...


3

BSD sockets is a tool. How secure is a hammer? It is as secure as you use it. BSD sockets is used in many (I would say major) critical applications. So, the only danger I see is when developers don't read the docs or the buggy system. I've never heart about any critical issue in sockets on linux. Hmm, what else to say? Maybe.... BSD sockets is a simple and ...


2

They may only have access to the Apache user account, but there may be another exploit or misconfiguration on your particular system that would enable an attacker to elevate their privileges to those of root. Local privilege escalation happens when one user acquires the system rights of another user. Network intruders have many techniques for increasing ...


4

You are right that you gain access to the UID of the process/script you exploited. In the case of the Apache identity with no mandatory access control and no proper separation of developer and apache roles, you can: destroy or deface the websites run by your Apache change websites' code to leak all the user database at a fixed URL that you can then consult ...


1

To add to what Mark said, it's also worth noting that execlp, execvp, and execvpe all invoke /bin/sh, as that's how they perform their path lookups. So, even without the 2nd-generational effects Mark mentions, just using the exec* family of functions does not guarantee bash will not be invoked. The correct fix is to make sure you have installed a patched ...


5

Wrong on both counts. In order to exploit the "shellshock" vulnerability, an attacker needs to control at least one environment variable (easy to do through CGI, SSH, or DHCP), and bash needs to be invoked at some point with the modified environment: directly as the result of an exec(), indirectly through system() or equivalent, highly indirectly through ...


8

You don't need to be using bash explicitly for this to be an issue. The real problem is allowing attackers to have a say in the value of environment variables. After the environment is set, it's only a matter of time before some shell gets executed (maybe unknown to you) with an environment it was not prepared for. Every program (bash, java, tcl, php, ...


1

They're the same vulnerability. CVE-2014-7169 was simply a bug found in the original patch for CVE-2014-6271 or "shell shock". CVE-2014-7169 allows us to side-step the patch released for BASH that was rolled out alongside the original bug disclosure for CVE-2014-6271. To test if your system is still vulnerable after applying the patch for CVE-2014-6271, ...


1

To answer your question: 1. There is no SHELLSHOCK threat as long you and your co-developers are aware what environment variable you are putting in or modifying (if any). By enabling executables, do you mean you call system binary via shell? If your Python or PHP is running via mod_cgi, there is vulnerability even if you don't use GET or POST data. To my ...


0

I had a similar setup for my production servers. The HTTP server load balancing was done by HAPROXY. I can recommend NGINX especially for the front facing server that will also handle SSL. Also I am not sure, what policy you are taking to transfer files to the host machines or getting terminal access. You probably need to think about opening up an SSH port ...


3

Both dhclient and dhcpcd call configuration scripts that invoke a system shell, so they are vulnerable. However, based on my testing it looks like you can run at least dhcpcd successfully without the config script (if you rename/move the script): $ pkill dhcpcd $ ping -c 1 www.google.com ping: unknown host www.google.com $ mv ...



Top 50 recent answers are included