· 9 years ago · Apr 04, 2017, 10:00 PM
1-> Table of Contents
2===============
3
41.1 - Introduction
51.2 - Identifying a firewall
61.3 - Identifying ports
71.4 - Some TCP / UDP ports and their services
81.5 - Network Monitoring
91.6 - Updating your OS
101.7 - p0f (sniffer)
111.8 - IPTRAF (Sniffer)
121.9 - Wireshark
132.0 - Router and PC
142.1 - Almost ending the theory (hehe '
152.2 - Sniffing the network
16
17-> Part 2
18==============
19
201.0 - SECURITY P. I
211.1 - FIREWALL
221.2 - wBuilder
231.3 - IPTABLES - Firewall
241.4 - Firewall Cyber ​​Hats version 1.1
251.5 - Intrusion Detection System (IDS)
261.6 - IDS Snort For server (WEB)
271.7 - Getting hidden on the internet
281.8 - How to clone a mac
291.9 - How to mask an ip
302.0 - Tuning of ips
312.1 - Sending Emails Anonymously
322.2 - HTTPS protocol
332.3 - Honeypots - The Irresistible Pot
342.4 - Honeynet
352.5 - Router Security
362.6 - Network Monitoring - Part. II
372.7 Network monitoring - Graphical interface
38
39-> Part 3
40=============
41
421.1 - Encrypting Critical Data - Truecrypt
431.2 - To the Smartmen, if you connect with PF, hit it ... FUDEU! - Destroying data.
441.3 - WIPE
451.4 - Script to clean All Logs
461.5 - Shred
471.6 - Cloning of cookies
481.7 - Identifying encryption manually - HARDCORE
491.8 - End of Ezine
50
51
52
53 Well guys lets start our ezine about security of your computers.
54So as you all know no system is totally safe,
55But there are those systems that are what we call the hacker medium of "armored machines".
56These machines have software that is specially developed for such functions as:
57
58 1.0 * Port filtering
59 * Package filtering
60 * Real network monitoring
61 * Monitoring of incoming or outgoing suspicious packet attempts (ICMP)
62 * Among many other tools they have for information security, the vast majority of them come in Open Source, which makes it much easier
63The lives of programmers and advanced users to perfect such scripts or sotwares.
64 But let's get down to business, we'll start with a superficial review of protocols
65And one of the most important for the footprint and the fingerprint ICMP Request and Response Package.
66In a little while you will find out why.
67
68
69 1.1 * ICMP packets
70
71Well I'll give you an explanation, the ICMP packages are meant to be the communication between two computers
72The scheme is as follows:
73
74
751) PC 1 -------- ICMP -> Network ---> -> -> PC 2
76
772º) PC 1 <------ icmp-- network <--- <- <- PC 2
78
79 IP PC1: 155.125.55
80 IP PC2: 200.84.98
81
82 In the 1 schematic the following occurs the PC 1 sends a "clean" ICMP packet but with destination and size pre intended
83Which is inoculated into the packet layers in the form of IP (address) and BYTES (size) ie PC 1 has sent
84A simple echo request to verify that Host (PC 2) was active.
85 With the successful communication the PC two re-sends the ICMP packet to the PC1 with the same data only that inverted
86Ie PC2 will send another ICMP packet to PC1 with standard size 64 byte (standard size), with this it can be seen that the
87Host (PC2) was active because it responded to the "calling" of PC1.
88 Well, the day to day of ordinary users is like this but as always has its exceptions there are people called LAMMERS / NOOBIES who make use of this
89Packet as a means of scanning computers more accurately check if there is firewall, open ports, operating system and / or network topology. But you must be wondering
90- How does for example the identification of so (operating system)? Very simple ! The tool has a database of
91What is the time at which each operating system takes to re-transmit the ICMP packet assuming:
92
93Red hat - 1500 ms
94Backtrack - 2000 ms
95Arch LInux - 500 ms
96
97 Through this the tool compares the time it took to receive the response and compares with the database thus making a ratio.
98
99
100
101
102==============================
103 1.2 * Identifying firewall
104==============================
105
106 A good method of identifying firewall is by ICMP packets, as most admins know the main function of ICMP packets they create rules
107For the machine to reject such packets, let's make a schematic:
108
109PC 1 ----> ---> ICMP (64 bytes) -> -> {FIREWALL} PC 2
110
111PC1 xxxxxxx.xxxxxxxxxxxxx.xxxxxxxxxx PC 2
112
113 Through this scheme it can be noted that when the packet arrived at the firewall there was the deviation or rejection of such packets by the machine
114Doing so that nothing returns to the attacker, then it will have nothing in response, nothing will return there is 2 hypotheses or the machine has a firewall
115Which is refusing packages or this machine does not exist.
116
117
118
119===========================
1201.3 * Identifying ports
121===========================
122
123 The ICMP package is also used to identify open ports and services running on the machine, the process for discovering open ports
124On certain machines is as follows:
125
126The attacker sends ICMP packets to the target (obvious hehe) but instead of going to a default ie being filtered by the firewall or any other means of
127Prevention can direct such packages to any ports an example:
128
129PC 1 ----> ICMP ---> -> -> PC 2 (p 23)
130PC 1 <---- ICMP <--- <- <- PC 2 (p 23 ON !!)
131
132Through this scheme it was concluded that the attacker who was PC 1 sent ICMP packets to a certain PC port 2 an example I used at 23 (Telnet)
133The PC 1 then tries to "connect" to this port, if it is online the ICMP packet will come back because it was filtered by the firewall. But if the ICMP
134Back in some cases means that the port is open ie the target host (PC 2) has responded to our "called" echo request.
135
136============================================================
1371.4 * Some TCP / UDP ports and their services
138============================================================
139
14021 ftp - file transfer
14122 ssh - remote control of machines
14223 telnet - remote control of machines
14325 smtp - email protocol
14480 browser - internet browsing
145113 pop3 - email protocol
146443 https - secure communication layer protocol
147===================================
148* 139 rpc - windows rpc protocol *
149===================================
150
151 - this last port I highlighted is the oldest port and you will only see it and totally unprotected systems with windows (= 3)
152Well, if you find anybody with the door open, do not miss the opportunity to invade it, of course the computer has a very bad security. Why do I say this?
153By the fact that with an exploit of msfconsole you can exploit this vuln (dcom).
154
155
156
157===========================
1581.5 Network Monitoring
159===========================
160
161 This theme is very important for both the attacking part and the defense, there are currently several tools and scripts that
162They do the real monitoring of the putaria that rolls in your network (hehe), the tools and snnifers are nothing more than tools that intercept the traffic
163Passively ie will not interfere in the "paths", destinations and data packets. Good, the theory has already been given so let's practice!
164 I will start by citing various tools, their functions and results from both the attacker's point of view and the defender's point of view.
165
166
167===========================
1681.6 Updating your OS
169===========================
170
171Well before you start "by the hand in the dough" let's first upgrade our operating system.
172
173Root @ CyberHats: ~ # apt-get update
174
175After completing execute the other command
176
177Root @ CyberHats: ~ # apt-get upgrade
178
179
180
181===================
1821.7 p0f (sniffer)
183===================
184
185Root @ CyberHats: ~ # p0f -i wlan0
186P0f - passive the fingerprinting utility, version 2.0.8
187(C) M. Zalewski <lcamtuf@dione.cc>, W. Stearns <wstearns@pobox.com>
188
189P0f: listening (SYN) on 'wlan0', 262 sigs (14 generic, cksum 0F1F5CA2), rule: 'all'.
190(Up: 24 hrs) [S10: 64: 1: 60: M1460, S, T, N, W7:.:?:?]
191 -> 66.252.2.46:80 (link: ethernet / modem)
192(Up: 24 hrs) [S10: 64: 1: 60: M1460, S, T, N, W7:.:?:?]
193 -> 66.252.2.46:80 (link: ethernet / modem)
194(Up: 24 hrs) [S10: 64: 1: 60: M1460, S, T, N, W7:.:?:
195 -> 69.31.76.42:80 (link: ethernet / modem)
196585.666.666: 55097 - UNKNOWN [up: 24: 1: 60: M1460, S, T, N, W7:.:?:
197 -> 173.252.100.27:80 (link: ethernet / modem)
198
199Well, let's go part by piece.
200
2011ª) At the start of the script it can be seen that it is executed in passive mode ie this sniffer
202Does not interfere with your network traffic.
203
2042) It detects in real time the transmission of the packets that are leaving your computer to the external medium (internet)
205As you can see in this example:
206
207+++++++++++++++++++++++ |
208585,666,666: 47572 - |
209 -> 66.252.2.46:80 |
210+++++++++++++++++++++++ |
211
212 My ip 585.666.666 (my PC) was communicating through port 47572 with the computer or ip server 66.252.2.46 on port 80,
213As you already know that port 80 is browser you can know that this is the ip of the site that I am accessing at the moment by my browser.
214
215
216
217=====================
2181.8 IPTRAF (Sniffer)
219=====================
220Good 1st step is to install iptraf, in the case of ubuntu (backtrack among others so of pentest).
221
222Root @ CyberHats: ~ # apt-get install IPTRAF
223
224After this it will automatically install itself, to execute it just follow the following command:
225
226Root @ CyberHats: ~ # iptraf -i "wlan0" (between quotation marks ["] is to modify by your network, eth0 or wlan0)
227
228After this it will start to run in passive mode (as we saw the definition) does not interfere in the operation of the network.
229
230================
2311.9 Wireshark
232================
233Good people, wireshark is a sniffer well known by users who practice pentest because it has an interface
234Very interactive with its use and be easy to understand, it is logical that the user has to have some basis on protocols of
235Because this software has many tools and the more advanced parts require more knowledge about network structures, we are going to
236A brief explanation about it:
237
238First let's install it
239
240Root @ CyberHats: ~ # apt-get install wireshark
241
242If this method has no effect or occurs some error can download by the official website.
243
244After downloading it already creates a shortcut in your menu bar, good lets rock in it.
245
246A brief explanation of networks:
247
248BOm as everyone knows for there to be communication between the computers there are communication platforms (grandpa !!)
249These connections are provided through packets that have functions and ports that specify where the interaction between
250Port and protocol, example:
251
252PC1 (PORT: 22 PROTOCOL: SSH) -----> COMMUNICATION ---> sending of packages -> -> PC2 (PORT: 22 PROTOCOL: SSH)
253PC1 (PORT: 80 PROTOCOL: SOCKET) -----> Communication ---> sending of packages -> -> PC2 (PORT: 80 PROTOCOL: SOCKET)
254
255As one can notice the communication of several packages with several computers occurs simultaneously, but no package interferes
256In the other, the communication "lines" occur in parallel, on the basis that each protocol interacts perfectly with its input medium
257 And output (ports).
258
259=================
2602.0 Router and PC
261=================
262
263Routers are devices that act smart and / or dumb (which often happens), it is the bridge to the external medium that is the internet
264So that you, user have access to the internet that is the external medium you need to be connected to one of these devices, or not (but let's not go into details).
265That is, the pc will have a connection ip and the other router, let's illustrate this:
266
267PC1 (192.168.0.0) --------------------> ROUTER (192.555.0.0) ----------> ****** *****************> INTERNET
268 /
269 /
270 /
271 /
272 /
273 /
274 /
275 **
276 PC2 (168,111,111)
277
278
279What I have tried to demonstrate to you is that your router or any devices that serve as a bridge to the internet connection
280Have different MAC and IP addresses, which is why there is a multiple connection of several PC's, but after several
281Connections it is very difficult for the router to handle the demand for packets, bytes and ports to open with it can occur from network crash.
282
283
284====================================
2852.1 Almost ending the theory (hehe '
286====================================
287
288Just kidding, I'm done with the theoretical part now, let's go to the software.
289
290
291======================
2922.2 Sniffing the network
293======================
294
295Well, the first step now is to go to start in the upper left corner and select the network you want to capture the packets.
296In my case it is eth0 so I will click on it and put START!
297
298At the moment you start capturing packages wireshark goes into passive mode and installs itself as a "collector" of packets in the pass
299From the internal medium to the external one which in the case of some people is the router.
300
301Let's illustrate this method:
302
303PC1 (192.168.0.0) --------------------> ROUTER (192.555.0.0) - | --- | ---------- > ***********************> INTERNET
304 / -----
305 / |
306 / |
307 / |
308 /
309 / WIRESAHRK
310 /
311 **
312 PC2 (168,111,111)
313
314
315* Software as you can see does not influence anything in the network flow it just does a kind of reading the information of the packages.
316 * Personal BOm, I'm sorry but it's not possible to teach wireshark completely but to give you a base both in networks and in this great software because its explanation
317Complete is somewhat complex so can use dorks to search the tutorials.
318
319
320The Most Sinister Part Hehe "
321
322====================
3231.0 SECURITY P. I
324====================
325
326==============
3271.1 FIREWALL
328==============
329
330Well obviously everyone who is reading this ezine should know what a firewall is so let's skip the boring part of having to explain what a firewall is firewalls work in a number of ways the most commonly used are firewalls at packet levels or at levels of Applications is impossible to talk about firewalls in linux without mentioning iptables.
331
332=============
3331.2 wBuilder
334=============
335
336
337Every network you need, you need a firewall! And this is an excellent tool that will help you to create the security settings.
338
339For 2.4 kernel users who are already accustomed to using iptables, this tool complements the work, making the creation of rules a simple task and with an advantage, when creating different groups that can use similar rules, you can use the Mouse to click and drag, transporting these settings to other groups, all in a very friendly environment.
340
341
342To install, use the command:
343
344# Apt-get install fwbuilder-iptables
345
346For more information, visit:
347Http://www.fwbuilder.org/
348
349
350
351
352========================
3531.3 IPTABLES - Firewall
354========================
355
356 Good people, let's go to a famous packet filterer better known as iptables.These software developed under GNU license was created in order to analyze the header of the packets that travel in your network so after this analysis iptables decides which actions Based on rules and predestined tables that users have already programmed into the command line interface (Shell) by the user.
357
358 Here is an example iptables script, to apply the following settings that are fictitious just write them in the shell of your system (I recommend linux). Do not worry if you do not understand what you are saying, after all none of the options have yet been presented, only Follows the script so you have a sense that an iptables firewall is command lines similar to these:
359
360 ################################################## ################
361 #OBS: CAUTION! As in almost all programming languages ​​the #
362 #caractere # means to comment and therefore the interpreter does not #
363 #considered as part of the code. #
364 ################################################## ################
365
366 Iptables -N block
367 Iptables -A block -m state --state ESTABLISHED, RELATED -j ACCEPT
368 Iptables -A block -m state --state NEW -i! Ppp0 -j ACCEPT
369 Iptables -A block -j DROP
370
371 ## Jump from the INPUT and FORWARD chains to the CHAIN ​​block.
372 Iptables -A INPUT -j block
373 Iptables -A FORWARD -j block
374
375
376
377
378 Well as you might expect there are several doubts, which is CHAIN, which means -A, -m, --state, among other syntaxes.
379 Iptables is divided into tables, KERNEL linux (which is the intermediary between software and hardware, NUCLEO operating system) already comes as default filter table that has 3 CHAIS (lists of rules):
380
381 # INPUT -> Packet Input
382
383 # OUTPUT -> packet output
384
385 # FORWARD -> package targeting
386
387 Example of application of the 3 CHAIS mentioned above (without syntax):
388
389 - You want to block any ICMP packet entry to make your host a bit more invisible; then a CHAIN ​​cancellation of a given packet is used by the "INPUT" CHAIN ​​which is the CHAIN ​​responsible for incoming packets.
390
391 - If you have not blocked the ICMP packet entry and some host sends an ECHO REQUEST, in a "biological" way, if the computer will respond with an ECHO REPLY or an ECHO REQUEST will enter the CHAIN ​​INPUT and an ECHO REPLY will exit through the CHAIN OUTPUT. If you do not want your computer not to return an ECHO REPLY to warn you that it is alive, simply cancel the ICMP packet output that is responsible for ECHO REPLY and ECHO REQUEST.
392
393 - You have some version of telnet outdated but your firewall is blocking the attacker's port scanning, and for this he is playing blind. The attacker discovers after several scanning techniques that you have an outdated telnet service but he does not discover the Port and as telnet by dedault runs on port 23 it will only run the exploit on port 23 as assumption. But if you do not have a lot of time to look for methods to update and stop the attacker exploiting on your system just give a FORWARD on Port 23 to another port such as 443 which is the https service (dummy method) the trafeco of port 23 will pass through port 443 blocking the exploit of the attacker since https is different from telnet.
394
395
396 To understand better we are going to make a first graph to illustrate how is the flow of packages in a computer without firewall or only with the rules INPUT and OUTPUT.
397
398
399
400 INPUT
401 Packages
402 ----------------
403 \/ OUTPUT
404 | ------------> I.NET
405 | |
406 | |
407 Eur-lex.europa.eu eur-lex.europa.eu
408 / \ | | / \
409 | INPUT | -----------------> | COMPUTER | --------------------> | OUTPUT |
410 \ _________ / | ____________ | \ _______ /
411
412
413
414 # In this scheme the packages follow the normal flow, that is the fragmented packets with header (incorrect header will be accepted) what can be a technique of fuzzing that is the sending of fragmented packages to a machine being that it was for this machine to reject it. As well as excess packets will also be accepted caused by a DoS or a DDoS.
415
416
417
418In this next diagram we will talk about a data flow in a computer that has a firewall with FORWAD enabled:
419
420
421
422 ENTRY of ________
423 Packages / \ OUTPUT
424 ----------------> ----------------------> | FORWARD | ---------------------------------------------->
425 \/ \________/ OUTPUT
426 | ------------> I.NET
427 | |
428 | |
429 Eur-lex.europa.eu eur-lex.europa.eu
430 / \ | | / \
431 | INPUT | -----------------> | COMPUTER | -------------------------> | OUTPUT |
432 \ _________ / | ____________ | \ _______ /
433
434
435
436
437
438 # In this schema the packets follow the flow but at the network entry FORWAD reads the header of the packets to see if any fits into the list of rules determined by the user, if it fits like the ICMP example instead of following it in INPUT -> go through the machine and go to -> OUTPUT it will fall straight on the FORWARD and it will be discarded.
439
440
441 Remember that there is not only the filter table, but since KERNEL adopts it as default (default) people get used to using it and forget about the other 2, they are:
442
443
444 -> filter: this table is the default if not declared in any rule, that is, it allows the filtering in INPUT (for packages intended for the machine itself), OUTPUT (for locally generated packages) and FORWARD rules (any packet that crosses The firewall, from one machine and directed to another).
445
446 -> nat: used when there is NAT or when a packet responsible for creating a new connection is found, ie when the "dport" (destination port) is different from the known IPs. Example: Passing data from a private network to the Internet. Supports chains PREROUTING (to change packets received before routing), OUTPUT (to change packets locally before routing) and POSTROUTING (to change the source address of the connections to something different).
447
448 -> mangle: is used to specify special actions for handling the traffic that crosses the chains. In this table there are two chains: PREROUTING and OUTPUT. Options with Service Type (TOS) are specified in this table to classify and considerably increase the speed of traffic considered in real time.
449
450
451
452 -> As I said inside the TABLES have the CHAINS, follow the difference between them:
453 IMPORTANT:
454
455 ## First, the names of the standard chains will be written in UPPERCASE instead of lowercase, because the INPUT and OUTPUT chains will only receive packets destined locally and generated locally. Previously, these chains target all incoming and outgoing packets, respectively.
456
457 ## The `-i 'flag now means input interface and only works in the INPUT and FORWARD chains. Rules in the FORWARD and OUTPUT chains that used `-i 'should be changed to` -o'.
458
459 ## TCP and UDP ports now need to be described with the --source-port or - sport (or --destination-port / - dport) options, which should be placed after the `-p tcp 'or` -p Udp ', since they carry the TCP or UDP extensions respectively.
460
461 ## The TCP flag -y is now --syn, and should be positioned after `-p tcp '.
462
463 ## Finally the DENY target is now DROP.
464
465 ## Zeroing chains while listing them works.
466
467 ## Zeroing standard chains also deletes the counters of your policies.
468
469 ## List chains also shows the counters.
470
471 ## REJECT and LOG are now target-extensions, ie they are separate KERNEL modules.
472
473 ## String names can be up to 31 characters long.
474
475 ## MASQ is now MASQUERADE and uses a different syntax. REDIRECT, although it retained the name, also underwent a syntax change. See the NAT HOWTO for more information on configuring both.
476
477 ## The -o option is no longer used to send the packages to the userspace device (see -i above). Packages are now sent to user space with QUEUE target.
478
479
480 -> I will pass the syntaxes that are from iptables to manage the tables and rules:
481
482
483
484 -P Defines a default rule
485
486 -A Adds a new rule to existing ones.
487 This has priority over the -P
488
489 -D A rule is deleted
490
491 -L List existing rules
492
493 -F Erases all rules
494
495 -I Inserts a new rule
496
497 -h Very useful as it shows the help
498
499 -R Replaces a rule
500
501 -C Make a check of existing rules
502
503 -Z Zero a specific rule
504
505 -N Creates a new rule with a name
506
507 -X Exclude a specific rule by its name
508
509
510
511 NOTE: I recommend whenever you create firewall rules to clear it before shutting down the computer with the syntax quoted above as:
512 # Iptables -F
513 Soon after this I created an initialization file with the firewall lines in bash (just follow the installation of superman firewall).
514
515
516
517
518-> Syntax for managing packet filtering water (taken from http://www.tccamargo.com/linux/tutoriais/iptables.html)
519
520-s: Specifies the source of the package. This can be either a network or a host. Possible combinations can be:
521
522-s 192.168.0.0/255.255.255.0
523
524or
525
526-s 192.168.0.0/24
527
528NOTE: In the second case we are specifying the netmask according to the number of bits 1, for example:
529
530Network mask 255.0.0.0 = 8
531Network mask 255.255.0.0 = 16
532Network mask 255.255.255.0 = 24
533
534
535In the above example we are specifying an entire network mask C, in the example below we specify a host:
536
537-s 192.168.30.51/255.255.255.255
538
539or
540
541-s 192.168.30.51
542
543Can also be as follows:
544
545-s 192.168.30.51/32
546
547NOTE: The mask in numbers of bits 1 to host is 32.
548
549
550We can also specify:
551
552-s www tccamargo.com
553
554
555We can specify any source too:
556
557-s 0.0.0.0.0.0.0.0
558
559or
560
561-s 0/0
562
563
564-d: Specifies the destination of the package. The syntax is the same as -s
565
566
567-p: Protocol used in rule. It can be tcp, udp, icmp:
568
569-p tcp
570-p udp
571-p icmp
572
573
574-i: Input interface, that is, network card, modem or connection interface that will be receiving the packet to be handled.
575
576-i eth0
577-i eth1
578-i ppp0
579
580
581-o: Output interface. The syntaxes are the same as -i, in which case you are sending the packet to be handled.
582
583
584! : Excludes certain argument:
585
586-i! Eth0 - Refers to any input interface except eth0
587-s ! 192.168.0.45 - Refers to any input address except 192.168.0.45
588
589
590--port: Refers to the originating port. This should be accompanied by the functions -p tcp and -p udp:
591
592-p tcp -sport 80 - Refers to source port 80 under tcp protocol
593
594
595--dport: Refers to the destination port. Like the -sport function, it works only with -p tcp and -p udp. The syntax is similar to -sport
596
597
598Through the -sport and -dport functions we can specify not only a specific port but also a port range:
599
600--port 33435: 33525
601
602################################################## ################################################## ###
603
604 Actions:
605
606The actions always comes after the -je parameter are usually:
607
608
609 ACCEPT - Accepts and allows the package to pass through.
610 DROP - Does not allow the packet to pass through and leaves the packet without giving any signals.
611 REJECT - Like DROP, it does not allow the packet to pass through, but sends a warning (icmp unreachable)
612 LOG - Creates a log for the rule in / var / log / messages
613
614
615-> Structure of an iptables string:
616
617With these factors we can create our rules with the following composition:
618
619
620 # Iptables -A FORWARD -s 192.168.0.45 -p icmp -j DROP
621 Being: -A (option) / FORWARD (Chain) / -s 192.168.0.45 -p icmp (Data) -j DROP (Action)
622
623################################################## ################################################## ####
624
625 -> Methods to save iptables rules:
626 There are two methods to save the rules created by iptables:
627
628
6291 - Saving the Rules
630
631
632 After the rules are ready we can save them with this command:
633
634 # Iptables-save> <give a file name>
635
636
637 To recover them use this command:
638
639 # Iptables-restore> <filename>
640
641
642
643
6442- Create a bash script for the rules to be executed, it is very simple to do this just go to a text editor and paste its rules successively and saved in .sh; Example name: FIREWALL.sh
645
646 Execution of the firewall: In linux or double click on the icon, in case it does not work go in the terminal enters the directory where the script is and type:
647 #bash name-script.sh
648
649 The following is an example of iptables bash script:
650
651
652
653
654 #! / Bin / bash
655
656#cleaning tables
657Iptables -F &&
658Iptables -X &&
659Iptables -t nat -F &&
660Iptables -t nat -X &&
661
662# Releasing internal network access
663Iptables -A INPUT -p tcp -syn -s 192.168.1.0/255.255.255.0 -j ACCEPT &&
664Iptables -A OUTPUT -p tcp -syn -s 192.168.1.0/255.255.255.0 -j ACCEPT &&
665Iptables -A FORWARD -p tcp -syn -s 192.168.1.0/255.255.255.0 -j ACCEPT &&
666
667# Sharing the web on the internal network
668Iptables -t nat -A POSTROUTING -s 192.168.1.0/255.255.255.0 -o eth1 -j MASQUERADE &&
669Echo 1> / proc / sys / net / ipv4 / ip_forward &&
670
671# Protection against hidden port scanners
672Iptables -A INPUT -p tcp -tcp-flags SYN, ACK, FIN, RST RST -m limit -limit 1 / s -j ACCEPT
673
674# Blocking tracertroute
675Iptables -A INPUT -p udp -s 0/0 -i eth1 -dport 33435: 33525 -j DROP
676
677#Protection against attacks
678Iptables -A INPUT -m state --state INVALID -j DROP
679
680#ends
681Echo "Iptables Pronto"
682
683
684 ################################################## #############################################
685
686-> I also recommend saving the script to put it to start automatically on your machine, you can do this with the following steps:
687
688 1- Go to the terminal and enter the directory (/etc/init.d) where the script is.
689
690 2- Save to the /etc/init.d/"secure.sh directory "->" secure.sh "is the name of the script.
691
692 3- root @ cyberhats: # chmod 755 /etc/init.d/secure
693
694
695====================================
6961.4 Firewall Cyber ​​Hats version 1.1
697====================================
698
699Well folks I made a simple firewall and I will send the source of it here for you it is barracing everything, if you are a user that wants to be protected with ctz you will be hehe now if you are a pentester that makes several invasions will need to make some modifications Simple to allow your tools to run without problems, you will have to put rules to accept the metasploit door and this is not difficult to do.
700
701I'm going to do a simple tutorial here on how to put it in the boot of your linux so every time you turn on the pc it will activate alone;)
702
7031 - Copy the source of it just under this heading and save it in a text file as the "firewall" name in the dir "/etc/init.d".
704
7052 - After doing this type in the terminal:
706
707Root @ cyberhats: # chmod 755 /etc/init.d/firewall
708
7093 - Then type in the terminal "update-rc.d firewall defaults":
710
711Root @ cyberhats: # update-rc.d firewall defaults
712Adding system startup for /etc/init.d/firewall ...
713/etc/rc0.d/K20firewall -> ../init.d/firewall
714/etc/rc1.d/K20firewall -> ../init.d/firewall
715/etc/rc6.d/K20firewall -> ../init.d/firewall
716/etc/rc2.d/S20firewall -> ../init.d/firewall
717/etc/rc3.d/S20firewall -> ../init.d/firewall
718/etc/rc4.d/S20firewall -> ../init.d/firewall
719/etc/rc5.d/S20firewall -> ../init.d/firewall
720
7214 - And now just start the firewall with the command "/etc/init.d/firewall start":
722
723Root @ cyberhats: # /etc/init.d/firewall start
724- Clearing rules: [OK]
725- Raising protection against ICMP ECHO-REQUEST messages sent to BROADCAST or MULTICAST: [OK]
726- Raising protection against ICMP redirect request: [OK]
727- Upload protection against redirected messages from ICMP: [OK]
728- PING: [OK]
729- Package Redirection: [OK]
730- SSH: [OK]
731- Stabilizing connections: [OK]
732- Block all connections: [OK]
733- Raising protection against ip spoofing: [OK]
734- Disabling IPv4 sending: [OK]
735- Protection against SYN-Flood: [OK]
736- Loopback: [OK]
737- Scans protection - [OK]
738- Protection against invalid SYN packets: [OK]
739- Protection against incoming packets that may cause loss of data: [OK]
740- Protection against malformed XMAS packets: [OK]
741- DNS: [OK]
742- NTP: [OK]
743- WHOIS: [OK]
744- FTP: [OK]
745- HTTP / HTTPS: [OK]
746- SMTP: [OK]
747- POP: [OK]
748- IMAP: [OK]
749- Reverse: [OK]
750- MSF: [OK]
751- Firewall Management: [OK]
752- Firewall [OK]
753
754
755The following is the source code of the firewall:
756
757-------------------------------------------------- ----------------------
758
759#! / Bin / sh
760# Fatal Error & Cyber ​​Hats
761# By Sup3rm4n
762#
763# .88888888
764# 88888888.88888.
765# .8888888888888888.
766# 88888888888888888888
767# 88 '_`88'_ `88888
768# 88 88 88 88 88888
769# 88_88 _ _ _ _ 88_: 88888
7708888
771# 88` ::::::::::8888
772.88: 8:88.
773# 88888: 888.
774# 888888.
775# .8888: .. ::. ...: '8888888 :. <--- THE PINGUIN KITTEN, I WOULD LIKE TO KNOW YOU BETTER ...
776# .8888. ' : 88: 88888 --- HAHA GATINHA SO LAMENTO, YOU WILL NOT PASS FROM MY FIREWALL HEHE.
777# .8888 '888: 8888.
778# 888: 8. 888: 88888
779# .888: 88.: 888: 88888:
7808888888. :: 88: 888888
781# 888. :: .88888888
782#. :::::::888. 8888 '.
783888 '. ::::::::::::::::::::::
784Eur-lex.europa.eu eur-lex.europa.eu
785Eur-lex.europa.eu eur-lex.europa.eu 888 :::::::::::::
78688: 88888 :::::::::::::::::::::::::
787Eur-lex.europa.eu eur-lex.europa.eu
788Eur-lex.europa.eu eur-lex.europa.eu
789#
790################################################## #############
791#
792# -> AVAILABLE LOGS AT: / var / log / firewall
793#
794# -> COMMANDS TO MONITOR LOGS: tail -f / var / log / messages
795#
796# -> Save to /etc/init.d/firewall
797#
798################################################## #############
799
800Case "$ 1" in
801Start
802
803# Clearing rules
804Iptables -t filter -F
805Iptables -t filter -X
806Echo - Clearing rules: [OK]
807
808# Deletes ICMP ECHO-REQUEST messages sent to BROADCAST or MULTICAST
809Echo 1> / proc / sys / net / ipv4 / icmp_echo_ignore_broadcasts
810Echo - Raising protection against ICMP ECHO-REQUEST messages sent to BROADCAST or MULTICAST: [OK]
811
812# Icmp request redirection protection
813Echo 0> / proc / sys / net / ipv4 / conf / all / accept_redirects
814Echo - Raising protection against ICMP redirection request: [OK]
815
816# Do not send ICMP redirected messages
817Echo 0> / proc / sys / net / ipv4 / conf / all / send_redirects
818Echo - Upload protection against redirected messages from ICMP: [OK]
819
820# ICMP (Ping)
821Iptables -t filter -A INPUT -p icmp -j ACCEPT
822Iptables -t filter -A OUTPUT -p icmp -j ACCEPT
823Echo - PING: [OK]
824
825# Log packages with non-existent mail (due to wrong routes) in your network
826Echo 1> / proc / sys / net / ipv4 / conf / all / log_martians
827
828# Enabling packet redirection (required for NAT)
829Echo "1"> / proc / sys / net / ipv4 / ip_forward
830Echo - Package Redirection: [OK]
831
832# SSH accepted
833Iptables -t filter -A INPUT -p tcp -dport 22 -j ACCEPT
834Echo - SSH: [OK]
835
836# Do not break established connections
837Iptables -A INPUT -m state --state RELATED, ESTABLISHED -j ACCEPT
838Iptables -A OUTPUT -m state --state RELATED, ESTABLISHED -j ACCEPT
839Echo - Stabilizing connections: [OK]
840
841# Block all connections by default
842Iptables -t filter -P INPUT DROP
843Iptables -t filter -P FORWARD DROP
844Iptables -t filter -P OUTPUT DROP
845Echo - Block all connections: [OK]
846
847# Ip spoofing protection
848Echo "1"> / proc / sys / net / ipv4 / conf / default / rp_filter
849Echo - Raising protection against ip spoofing: [OK]
850
851# Disable IPV4 sending
852Echo 0> / proc / sys / net / ipv4 / ip_forward
853Echo - Disabling IPv4 sending: [OK]
854
855# SYN-Flood Protection
856Iptables -N syn-flood
857Iptables -A syn-flood -m limit -limit 10 / second --limit-burst 50 -j RETURN
858Iptables -A syn-flood -j LOG --log-prefix "SYN FLOOD:"
859Iptables -A syn-flood -j DROP
860Echo - Protection against SYN-Flood: [OK]
861
862# Loopback
863Iptables -t filter -A INPUT -i lo -j ACCEPT
864Iptables -t filter -A OUTPUT -or -j ACCEPT
865Echo - Loopback: [OK]
866
867# Deletes scans connections
868Iptables -A INPUT -m recent --name scan --update --seconds 600 --rttl --hitcount 3 -j DROP
869Iptables -A INPUT -m recent --name scan --update --seconds 600 --rttl --hitcount 3 -j LOG --log-level info --log-prefix "Recent scan"
870Echo - Scans protection - [OK]
871
872# Deletes invalid SYN packets
873Iptables -A INPUT -p tcp -tcp-flags ALL ACK, RST, SYN, END -j DROP
874Iptables -A INPUT -p tcp -tcp-flags SYN, END SYN, END -j DROP
875Iptables -A INPUT -p tcp -tcp-flags SYN, RST SYN, RST -j DROP
876Iptables -A INPUT -p tcp -tcp-flags ALL ACK, RST, SYN, FIN -j LOG --log-level info --log-prefix "SYN Packages Detected"
877Iptables -A INPUT -p tcp -tcp-flags SYN, END SYN, END -j LOG --log-level info --log-prefix "SYN Packages Detected"
878Iptables -A INPUT -p tcp -tcp-flags SYN, RST SYN, RST -j LOG --log-level info --log-prefix "SYN Packages Detected"
879# Deletes invalid SYN packets
880Iptables -A OUTPUT -p tcp -tcp-flags ALL ACK, RST, SYN, END -j DROP
881Iptables -A OUTPUT -p tcp -tcp-flags SYN, END SYN, END -j DROP
882Iptables -A OUTPUT -p tcp -tcp-flags SYN, RST SYN, RST -j DROP
883Iptables -A INPUT -p tcp -tcp-flags ALL ACK, RST, SYN, FIN -j LOG --log-level info --log-prefix "SYN Packages Detected"
884Iptables -A INPUT -p tcp -tcp-flags SYN, END SYN, END -j LOG --log-level info --log-prefix "SYN Packages Detected"
885Iptables -A INPUT -p tcp -tcp-flags SYN, RST SYN, RST -j LOG --log-level info --log-prefix "SYN Packages Detected"
886Echo - Protection against invalid SYN packets: [OK]
887
888# Make sure that new packages are SYN, otherwise drop them
889Iptables -A INPUT -p tcp! --syn -m state --state NEW -j DROP
890
891# Discards packets with input fragments. Attack that can cause loss of data
892Iptables -A INPUT -f -j DROP
893Iptables -A INPUT -f -j LOG --log-level info --log-prefix "Fragmented Input Pct"
894Echo - Protection against incoming packets that may cause loss of data: [OK]
895
896# Defeat badly formed XMAS packets
897Iptables -A INPUT -p tcp -tcp-flags ALL ALL -j DROP
898Iptables -A INPUT -p tcp -tcp-flags ALL ALL -j LOG --log-level info --log-prefix "Badly formed XMAS packages"
899Echo - Protection against malformed XMAS packets: [OK]
900
901# DNS In / Out
902Iptables -t filter -A OUTPUT -p tcp -dport 53 -j ACCEPT
903Iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
904Iptables -t filter -A INPUT -p tcp -dport 53 -j ACCEPT
905Iptables -t filter -A INPUT -p udp -dport 53 -j ACCEPT
906Echo - DNS: [OK]
907
908# NTP Out
909Iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT
910Echo - NTP: [OK]
911
912# WHOIS Out
913Iptables -t filter -A OUTPUT -p tcp -dport 43 -j ACCEPT
914Echo - WHOIS: [OK]
915
916# FTP Out
917Iptables -t filter -A OUTPUT -p tcp -dport 20:21 -j ACCEPT
918Iptables -t filter -A OUTPUT -p tcp -dport 30000: 50000 -j ACCEPT
919# FTP In
920Iptables -t filter -A INPUT -p tcp -dport 20:21 -j ACCEPT
921Iptables -t filter -A INPUT -p tcp -dport 30000: 50000 -j ACCEPT
922Iptables -t filter -A INPUT -m state --state ESTABLISHED, RELATED -j ACCEPT
923Echo - FTP: [OK]
924
925# HTTP + HTTPS Out
926Iptables -t filter -A OUTPUT -p tcp -dport 80 -j ACCEPT
927Iptables -t filter -A OUTPUT -p tcp -dport 443 -j ACCEPT
928# HTTP + HTTPS In
929Iptables -t filter -A INPUT -p tcp -dport 80 -j ACCEPT
930Iptables -t filter -A INPUT -p tcp -dport 443 -j ACCEPT
931Echo - HTTP / HTTPS: [OK]
932
933# SMTP Mail: 25
934Iptables -t filter -A INPUT -p tcp -dport 25 -j ACCEPT
935Iptables -t filter -A OUTPUT -p tcp -dport 25 -j ACCEPT
936Echo - SMTP: [OK]
937
938# POP3 Mail: 110
939Iptables -t filter -A INPUT -p tcp -dport 110 -j ACCEPT
940Iptables -t filter -A OUTPUT -p tcp -dport 110 -j ACCEPT
941Echo - POP: [OK]
942
943# IMAP Mail: 143
944Iptables -t filter -A INPUT -p tcp -dport 143 -j ACCEPT
945Iptables -t filter -A OUTPUT -p tcp -dport 143 -j ACCEPT
946Echo - IMAP: [OK]
947
948# Reverse
949Iptables -t filter -A INPUT -p tcp -dport 77 -j ACCEPT
950Iptables -t filter -A OUTPUT -p tcp -dport 77 -j ACCEPT
951Echo - Reverse: [OK]
952
953# MSF
954Iptables -t filter -A INPUT -p tcp -dport 7337 -j ACCEPT
955Iptables -t filter -A OUTPUT -p tcp -dport 7337 -j ACCEPT
956Echo - MSF: [OK]
957
958#######################################
959# Firewall WEB Management
960Touch / var / log / firewall
961Chmod + x / var / log / firewall
962/ Var / log / firewall -A INPUT -p icmp -m limit -limit 1 / s -j LOG --log-level info --log-prefix "ICMP Dropped"
963/ Var / log / firewall -A INPUT -p tcp -m limit -limit 1 / s -j LOG --log-level info --log-prefix "TCP Dropped"
964/ Var / log / firewall -A INPUT -p udp -m limit -limit 1 / s -j LOG --log-level info --log-prefix "UDP Dropped"
965/ Var / log / firewall -A INPUT -f -m limit -limit 1 / s -j LOG --log-level warning --log-prefix "FRAGMENT Dropped"
966/ Var / log / firewall -A INPUT -m limit -limit 1 / minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died:"
967/ Var / log / firewall -A INPUT -m limit -limit 3 / minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died:"
968Echo - Firewall Management: [OK]
969
970Echo - Firewall [OK]
971Exit 0
972;;
973
974Stop
975Echo "Turning Off Firewall ..."
976Iptables -P INPUT ACCEPT
977Iptables -P OUTPUT ACCEPT
978Iptables -t filter -F
979Echo "Firewall Off!"
980Echo "Coded By Sup3rm4n"
981Exit 0
982;;
983
984restart)
985/etc/init.d/firewall stop
986/etc/init.d/firewall start
987;;
988
989*)
990Echo "Usage: /etc/init.d/firewall {start | stop | restart}"
991Exit 1
992;;
993Esac
994
995-------------------------------------------------- -------------------------------------------------- ------------
996
997========================================
998Intrusion Detection System (IDS)
999========================================
1000
1001So IDS also known as intrusion detection system capture real-time intrusion attempts, its operation is very simple and effective, IDS analyzes all the packets that are traveling in the network and searches for strange signatures all the signatures that flee from the Are classified as an attack, IDS can only act by alerting the admins or by applying actions to prevent attacks.
1002
1003There are two types of IDS that are placed on the network where the host to be monitored are known as NIDS and host based systems known as HIDS are placed on the host to be monitored.
1004
1005
1006=================================
10071.6 IDS Snort For server (WEB)
1008=================================
1009
1010
1011An Intrusion Detection System (IDS) is a tool that analyzes network traffic and logs intrusion attempts. It is possible to study the methods used by these "predators" and based on these reports, create new security rules.
1012
1013For this type of service, Snort is the most commonly used tool on servers spread over the internet. Besides its use in Linux, it is also available for Windows, and can be downloaded in both versions on your site.
1014
1015Add this line to your sources.list:
1016
1017Deb http://people.debian.org/~ssmeenk/snort-stable-i386/ ./
1018
1019To install, use the command:
1020
1021# Apt-get install snort
1022
1023The snort is the best NIDS I know, if anyone knows a better tell me hehe, you can download it on his official website tb "http://www.snort.org/start/download" this tool is an open source made in C developed by Martin Roesch so you can make the modifications you want in it according to what you need.
1024
1025How to use it:
1026
1027After you download it you will configure the snort.conf file that usually stays in /etc/snort/snort.conf, so let's go there.
1028
1029Root @ cyberhats: # vim /etc/snort/snort.conf
1030
1031On your terminal you will edit the following parts of the file:
1032
1033--------------------------
1034
1035# Like this:
1036
1037Var HOME_NET XXX.XXX.XXX.XXX <--- instead of xxx.xxx.xxx.xxx put the host ip to be monitored
1038
1039# Set up the external network addresses as well. A good start may be "any"
1040Var EXTERNAL_NET any <--- make sure to be any if you want to be alerted when any ip attempts any attack against your host
1041#var EXTERNAL_NET! $ HOME_NET
1042
1043-------------------------
1044
1045Then run the snort with the command:
1046
1047Root @ cyberhats: # service snort start
1048
1049Then put it on alert with the command:
1050
1051Root @ cyberhats: # snort -q -A console -i wlan0 -c /etc/snort/snort.conf <- wlan0 is my interface change according to your
1052
1053To verify that snort is actually extinguishing:
1054
1055Root @ cyberhats: # ps ax | Grep snort
1056
1057Ready is on alert and is already more protected your system hehe
1058
1059================================
10601.7 Getting hidden on the internet
1061================================
1062
1063Almost everything we do gets registered on the Internet and this much of the time
1064Can be used against you, an ordinary user rarely has privacy
1065On the internet because everything he does is registered, with a simple search in the
1066Google you can discover information from a person who does not know if
1067Protect and remain anonymous, in addition almost all websites visited
1068If you are like me and value your privacy, but do not know
1069How to stay anonymous on the internet I advise reading is part of the ezine. It is
1070Part is more directed to Beginners or Noobs so if you are a guy
1071That already manja of the paranaues can skip this part.
1072
1073A great website for you to check the level of your anonymity is the Internet site
1074Troubleshooting and Forensics (IPduh) in addition it is an excellent site for
1075Fingerprint and footprint (which will be
1076Our ezine), the url of the website is: http://ipduh.com/anonymity-check/
1077
1078OOK then enough of scrolling and let's go to what really matters, the websites that you
1079Logs, although Anatel does not specifically
1080The data to be stored for discussion in debate PL 84/1999 and Civil Framework
1081States that only date, time, ip and gmt are sufficient to discover
1082everything about you.
1083
1084Almost all people use google.com only unfortunately google captures information
1085Its for this reason I advise you to use other search engines that are execelentes such as
1086Https://startpage.com and https://duckduckgo.com/ and do not store your data.
1087
1088One way to trick this system so they do not get their data is through proxies
1089And vpns but everyone knows what proxys and vpns are if you do not know just take a look
1090In google that has several tutos explaining, but even with proxy
1091And vpns it is possible to get to you through a reverse it is clear that the person who
1092Want to find out your location will have more trick but only with proxy and vpns you still do not
1093Is a safer way to stay anonymous is to use a mac + ip cloned
1094And a tunneling of ips so let's go there:
1095
1096=======================
10971.8 How to clone a mac
1098=======================
1099
1100First we must type in the terminal ifconfig
1101
1102Root @ cyberhats: # ifconfig
1103Eth0 Link encap: Ethernet HW address 00: 06: 0a: ea: dc: 73
1104 UP BROADCASTMULTICAST MTU: 1500 Metric: 1
1105 RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 0
1106 TX packets: 0 errors: 0 dropped: 0 overruns: 0 carrier: 0
1107 Collisions: 0 txqueuelen: 1000
1108 RX bytes: 0 (0.0 B) TX bytes: 0 (0.0 B)
1109 IRQ: 45 I / O address: 0x2000
1110
1111Wlan0 Link encap: Ethernet Address of HW 40: 3a: 05: 96: 5a: 10
1112 Inet end .: 191.162.1.24 Bcast: 192.168.1.255 Mass: 255.255.255.0
1113 Address inet6: fe80 :: 721a: 4ff: fe69: 7a20 / 64 Scope: Link
1114 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1115 RX packets: 36652 errors: 0 dropped: 0 overruns: 0 frame: 0
1116 TX packets: 28333 errors: 0 dropped: 0 overruns: 0 carrier: 0
1117 Collisions: 0 txqueuelen: 1000
1118 RX bytes: 39117265 (37.3 MiB) TX bytes: 4597970 (4.3 MiB)
1119
1120Ethe0 is the wired network card and its MAC is 00: 03: 0d: ea: dc: 96 and wlan0
1121Is the wireless network card with MAC 40: 3a: 05: 96: 5a: 10
1122
1123To change the MAC first you need to drop the wlan0 and then rebuild
1124With the new configs for this we use the command "ifconfig wlan0 down"
1125
1126Root @ cyberhats: # ifconfig wlan0 down
1127
1128Now just change the configs and raise the network again very simple :) to change the mac
1129Just type the command "ifconfig wlan0 hw ether xx: xx: xx: xx: xx: xx" where xx you will place
1130The new Mac you want.
1131
1132Root @ cyberhats: # ifconfig wlan0 hw ether 16: cd: 26: ab: 69: ef
1133
1134Then you use the "ifconfig wlan0 up" command to raise the net and that's it.
1135
1136Root @ cyberhats: # ifconfig wlan0 up
1137
1138
1139========================
11401.9 How to mask an ip
1141========================
1142
1143Masquerading an ip is a technique used in the hacker medium because you can create a
1144It will mask on top of the other which will make it almost impossible to identify you.
1145
1146To mask an ip simply type in the terminal the command "ifconfig wlan0: 1 xxx.xxx.xxx.xxx"
1147Where xxx.xxx.xxx.xxx is the ip that is masking the true one.
1148
1149Root @ cyberhats: # ifconfig wlan0: 1 192.158.0.126
1150
1151Root @ cyberhats: # ifconfig
1152
1153Eth0 Link encap: Ethernet HW address 00: 06: 0a: ea: dc: 73
1154 UP BROADCASTMULTICAST MTU: 1500 Metric: 1
1155 RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 0
1156 TX packets: 0 errors: 0 dropped: 0 overruns: 0 carrier: 0
1157 Collisions: 0 txqueuelen: 1000
1158 RX bytes: 0 (0.0 B) TX bytes: 0 (0.0 B)
1159 IRQ: 45 I / O address: 0x2000
1160
1161Wlan0 Link encap: Ethernet Address of HW 40: 3a: 05: 96: 5a: 10
1162 Inet end .: 191.162.1.24 Bcast: 192.168.1.255 Mass: 255.255.255.0
1163 Address inet6: fe80 :: 721a: 4ff: fe69: 7a20 / 64 Scope: Link
1164 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1165 RX packets: 36652 errors: 0 dropped: 0 overruns: 0 frame: 0
1166 TX packets: 28333 errors: 0 dropped: 0 overruns: 0 carrier: 0
1167 Collisions: 0 txqueuelen: 1000
1168 RX bytes: 39117265 (37.3 MiB) TX bytes: 4597970 (4.3 MiB)
1169
1170Wlan0: 1 Link encap: Ethernet HW address 12: ab: 34: cd: 56: ef
1171 Inet end .: 192.158.0.126 Bcast: 192.168.1.255 Mass: 255.255.255.0
1172 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1173
1174Did you see what happened? It will create a mask that will hide your true ip
1175And the only address that will be used is the masquerade so you will be protected
1176To create a mask on another just go adding them in the same way
1177That the first only go changing the numbers of them that will be added other masks
1178Which will overlap one over another. Ps: This method does not protect your external ip only the internal one.
1179
1180Root @ cyberhats: # ifconfig wlan0: 1: 2 192.128.0.45
1181
1182Root @ cyberhats: # ifconfig
1183
1184Eth0 Link encap: Ethernet HW address 00: 06: 0a: ea: dc: 73
1185 UP BROADCASTMULTICAST MTU: 1500 Metric: 1
1186 RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 0
1187 TX packets: 0 errors: 0 dropped: 0 overruns: 0 carrier: 0
1188 Collisions: 0 txqueuelen: 1000
1189 RX bytes: 0 (0.0 B) TX bytes: 0 (0.0 B)
1190 IRQ: 45 I / O address: 0x2000
1191
1192Wlan0 Link encap: Ethernet Address of HW 40: 3a: 05: 96: 5a: 10
1193 Inet end .: 191.162.1.24 Bcast: 192.168.1.255 Mass: 255.255.255.0
1194 Address inet6: fe80 :: 721a: 4ff: fe69: 7a20 / 64 Scope: Link
1195 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1196 RX packets: 36652 errors: 0 dropped: 0 overruns: 0 frame: 0
1197 TX packets: 28333 errors: 0 dropped: 0 overruns: 0 carrier: 0
1198 Collisions: 0 txqueuelen: 1000
1199 RX bytes: 39117265 (37.3 MiB) TX bytes: 4597970 (4.3 MiB)
1200
1201Wlan0: 1 Link encap: Ethernet HW address 12: ab: 34: cd: 56: ef
1202 Inet end .: 192.158.0.126 Bcast: 192.168.1.255 Mass: 255.255.255.0
1203 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1204
1205Wlan0: 1: 2 Link encap: Ethernet HW address 12: ab: 34: cd: 56: ef
1206 Inet end .: 192.128.0.45 Bcast: 192.168.1.255 Mass: 255.255.255.0
1207 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1208
1209Now if you do not want to do this manually here is the source of a tool made by b4ckd00r that does all these steps for you:
1210-----------------------------------------
1211#! Bin / sh
1212Ifconfig wlan0 down
1213Ifconfig wlan0 down
1214Ifconfig wlan0 hw ether 16: cd: 26: ab: 69: ef
1215Ifconfig wlan0 down
1216Ifconfig wlan0 hw ether 16: cd: 26: ab: 69: ef
1217Ifconfig down
1218Ifconfig wlan0: 1 192.158.0.126
1219Ifconfig wlan0: 1: 2 50.5.26.10
1220Ifconfig wlan0: 1: 2: 3 40.52.86.32
1221Ifconfig wlan0: 1: 2: 3: 4 10.15.24.55
1222Ifconfig wlan0 up
1223Echo Success in operation!
1224----------------------------------------
1225
1226=======================
12272.0 Tuning of ips
1228=======================
1229
1230The tunneling method of ips that I will describe here was created by my brother
1231DrakeDoS, is an execelente method to protect your ip. The following steps should
1232Be made:
1233
12341 - Login to the site http://www.cjb.net
1235
12362 - Go to the guide http://www.cjb.net/shell.html
1237
12383 - Register an account
1239
12404 - Install ssh, if necessary, type in a terminal "sudo apt-get install ssh"
1241
12425 - Start the ssh server, for the tunneling, typing on a terminal ssh -D 127.0.0.1:1085 usuario@shell.cjb.net
1243
12446 - after pressing ENTER, ssh will ask for the registered password.
1245
12467 - Download tollbar FOXY PROXY (Standard), for your firefox.
1247
12488 - open Firefox again, and right click on the FOXY PROXY icon and go to the Options tab
1249
12509 - in the FOXY PROXY Standard window that you have opened, click Add New Proxy
1251
125210 - will open another window where you have to configure the settings, such as IP 127.0.0.1 and port 1085 and dial SOCKS PROXY?
1253
125411 - in the General tab it is possible to name the tunneling and change the color of the icon that indicates the connection. Default name: Tunnel
1255
125612 - after everything done, just give ok in both windows of FOXY PROXY, and click on the FOXY PROXY icon with the right mouse button
1257
125813 - and choose the option referring to the tunneling made, in this case of example, select the connection "Tunnel"
1259
126014 - Ready the tunneling is created. Enjoy! : D
1261
1262This is the one to configure it after done so if you want to use it again just follow these steps:
1263
12641 - Start the ssh server, for the tunneling, type in a terminal ssh -D 127.0.0.1:1085 usuario@shell.cjb.net
12652 - open firefox, and click the FOXY PROXY icon with the right mouse button, and select the option "Tunnel"
12663 - Test the anonymity at http://ipduh.com/anonymity-check/ and you're done! :)
1267
1268IMPORTANT NOTE: DO NOT CLOSE THE TERMINAL NECESSARY FOR SSH CONNECTION OR AUTOMATICALLY SESSA TUNNEL!
1269
1270=================================
12712.1 Sending Emails Anonymously
1272=================================
1273
1274Emailing anonymously is a very simple technique that can be very useful for social engineering, bankers
1275Use this technique for centuries to get passwords they send an email type adminitracao@bradesco.com asking for the password
1276Of the person if it is a person who does not know this trick will send the password believing it is really an email
1277It can be useful for you to create accounts anonymously. Imagine that you want to register with a
1278Website and this part your email to make the registration in this case you can use an email that auto delete in 10
1279Minutes so keep your anonymity has countless utilities but enough of fla and let's go to what matters.
1280
1281Some sites that email anonymously are:
1282
1283Send fake email you can send msgs with sup3rm4n@fbi.gov emails
1284Http://emkei.cz/
1285Http://deadfake.com/Send.aspx
1286
1287Anonymous emails that do not register anything about you and protect your anonymity:
1288Http://www.yopmail.com/en/
1289Http://tormail.org/
1290
1291Email that auto deletes after 10 min:
1292Http://10minutemail.com/
1293Http://10minutemail.net/pt/
1294
1295====================
12962.2 HTTPS protocol
1297====================
1298
1299With the great advance of the communication platforms some being safe and others not
1300Occurred the need to create encrypted means in which even if third parties intercepted
1301Would not have any value, and so the https protocol is born. The https protocol protects you against
1302Man in the middle attacks and sniffers allows a more secure connection;)
1303
1304The tor project has created an application called HTTPS EVERYWHERE it is based on the NoScript STS implementation
1305It makes your connection more secure on all websites that support ssl.
1306
1307For more information about it or to download it, visit the link: https://trac.torproject.org/projects/tor/query?status=accepted&status=assigned&status=needs_information&status=needs_review&status=needs_revision&status=new&status=reopened&groupdesc=1&group=type&max= 200 & component = EFF-HTTPS + Everywhere & component = HTTPS + Everywhere% 3A + Chrome & order = priority & col = id & col = summary & col = component & col =
1308
1309
1310
1311======================================
13122.3 Honeypots - The Irresistible Pot
1313======================================
1314 Honeypots do not have this name atoa, after all when you are scanning a network and come across an outdated, open and / or vulnerable service gives an overwhelming desire to exploit.
1315 Honeypots simulate these services that for the attacker are vulnerable but this vulnerability was purposely imposed by the network administrator through a software, honeypots that are systems that are vulnerable, attracting invaders that, when connected to the system, will be monitored. , Techniques, vulnerabilities and tools are obtained for analysis and protection of systems.
1316
1317 "A honeypot exists only to be invaded," explains Christian Seifert, executive director of the Honeynet Project.
1318
1319 There are different types of honeypots, they are:
1320
1321 Low Interaction Honeypot - All services and vulnerabilities are simulated and the attacker will never have access to the real system. It's just a fantasy world. In this type of honeypot, the trap can be mounted through programs that simulate vulnerable environments.
1322 * Advantages: The attacker can not gain privileges and exploit other machines on the network.
1323 * Disadvantages: A more experienced hacker can quickly detect the farce and disconnect from the system, but until that happens, the honeypot has already recorded some of its activities and network address.
1324
1325 High Interaction Honeypot - This is a real system, for example you install the machine, operating system and vulnerable services and expose it to the Internet. The most recommended is to have an isolated structure for the honeypot, not having connection with the current network of production or research.
1326 * Advantages: Difficult identification of the trap by the hacker, because it is a real environment, and their actions are sent to another computer, preventing them from being lost if the hacker detonates the operating system.
1327 * Disadvantages: Depending on the vulnerability, a hacker can use other types of attacks and use the real system to hack into other machines on the network.
1328 Simply put, it would look like this:
13291 - A vulnerable environment is set up, so that hackers can find and begin to exploit the system, thinking that it is a real target.
1330During this invasion, all actions of the hacker are monitored and can be used in the future as a standard of study.
1331
1332Since most corporate attacks have some internal help, it can be useful to use honeypots to find out who is sabotaging (deleting, altering).
1333
1334Some honeypots:
1335- honeyd - LINUX (# apt-get install honeyd)
1336- Valhala Honeypot - WINDOWS (http://ziggi.uol.com.br/downloads/valhala-honeypot)
1337
1338
1339==============
13402.4 Honeynet
1341==============
1342
1343 Definition 1: A Honeynet is a search tool, which consists of a network specifically designed to be compromised, and which contains control mechanisms to prevent it being used as a basis for attacks against other networks.
1344
1345Definition 2: A Honeynet is nothing more than a type of honeypot. Specifically, it is a high interactivity honeypot, designed for research and gathering information from intruders. It is also known as "search honeypot".
1346
1347Once compromised, the honeynet is used to observe the behavior of the attackers, allowing for detailed analysis of the tools used, their motivations and exploited vulnerabilities.
1348
1349A honeynet typically contains a network segment with honeypots from various operating systems and that provide various applications and services. It also contains robust containment mechanisms with multiple levels of control, as well as systems for capturing and collecting data, and for generating alerts.
1350
1351 There are two types of honeynets: the actual honeynets (or simply honeynets) and the virtual honeynets:
1352
1353 * Real Honeynets
1354
1355In a real honeynet the devices that make it up, including honeypots, containment mechanisms, alert and information gathering, are physical.
1356
1357For example, a real honeynet could be composed of the following devices:
1358
1359 * Several computers, one for each honeypot. Each honeypot with a real operating system, applications and services installed;
1360 * A computer with a firewall installed, acting as a mechanism for containment and data collection;
1361 * A computer with an IDS installed, acting as a mechanism for generating alerts and collecting data;
1362 * A computer acting as a repository of collected data;
1363 * Hubs / switches and router (if required) to provide the honeynet network infrastructure.
1364
1365The advantages of this type are: low cost per device; More fault-tolerant (environment is distributed), and attackers interact with real environments.
1366
1367The main disadvantages are: more difficult and laborious maintenance; Need for more physical space for the equipment, and total cost tends to be higher.
1368
1369 * Virtual Honeynets
1370
1371A virtual honeynet is based on the idea of ​​having all the components of a honeynet implemented in a reduced number of physical devices. For this, a single computer with an installed operating system is usually used, which is the basis for the execution of virtualization software, such as VMware (Virtual Infrastructure Software) or UML (User Mode Linux). Virtualization software allows you to run multiple operating systems with applications and services installed at the same time.
1372
1373Virtual honeynets are further subdivided into two categories: self-containment and hybrids. In the first, all mechanisms, including contention, capture and data collection, generation of alerts and honeypots (implemented through virtualization software) are on a single computer. In the second, the mechanisms of containment, capture and data collection and generation of alerts are executed in distinct devices and the honeypots in a single computer with a virtualization software.
1374
1375 * The advantages of virtual honeynets are: simpler maintenance; Need for less physical space for the equipment, and final cost tends to be lower.
1376
1377The main disadvantages are: high cost per device, as more robust equipment is needed; Low fault tolerance (many components concentrated in a single point); Virtualization software can limit the hardware and operating systems used; The attacker can gain access to other parts of the system because everything shares the resources of the same device (in the case of the self-containment category), and the attacker's ability to discover that he is interacting with a virtual environment.
1378
1379It can be said that a honeynet is characterized as being a type of honeypot of high interaction developed with the main intuition of research, for its operation usually it is to create users, to send emails, it generates of histories and documents, And all the services commonly used in an actual production system, in order to ensure that the service itself is not detected by any possible intruder (MARCELO, ANTONIO, 2003).
1380 * One factor to consider are the problems of false positive and false negative. The false positive occurs when there is a problem in the network or connection and it ends up being interpreted as a real attack
1381
1382For more information and mirrors: http://old.honeynet.org/
1383
1384
1385============================
13862.5 Router Security
1387============================
1388
1389
1390Well if this ezine is addressing more security-oriented texts nothing better than say about wireless networks. Currently, the demand for routers and wireless signals are high, so the invaders are happier. A little note when we go Say example: -Here there an internet signal?
1391It is not said - here has Wifi signal. Because Wi-fi was a "conference" and a union of several companies from around the world to determine signal patterns and equipment.
1392Wifi = Wireless Fidelity The right thing to do is ask if there is a wireless signal here.
1393 But without curling let's go to the first topic on security in routers;
1394
1395
1396-> Passwords
1397
1398 Then the most controversial subject = 'c Let's start, although most attacks on wireless networks are not based on brute force but rather on packages that are created with own software that sniff that network; Sniffar = capture network data, whether corporate or home network. Even though attacks on networks by brute force lose to packet analysis we must have a strong password, when I say strong I speak in at least 8 to 10 digits (MINIMUM) containing
1399The characters in alphanumeric, symbolic, etc.
1400 Fucking on I.net (which sucks crap) I found some interesting links to test passwords like:
1401 -> https://www.microsoft.com/en-us/security/pc-security/password-checker.aspx
1402
1403
1404
1405-> Cryptography
1406
1407 The security of the network does not depend only on the password, as I said the attacks on wireless networks via brute force lose to the packet analysis, ie IF the password is strong will only solve a problem, even "SE"! .
1408 The great precursor of security in the "Digital Age" is cryptography that has provided more "comfort" to administrators, country presidents, business owners, and ultimately all who use i.net.
1409 There are several types of encryption in i.net currently running in various applications such as the flow of information from banking transactions on e-commerce sites, encryption of critical files for administration of a site such as User and pass.Cryptography is certainly pressing In all places that I.net is, but as we are talking about routers we will only talk about the encryption that is used to encrypt passwords and information traffic over the WAN (internet structure that can cross states, countries and continents. I.net is nothing more than a gigantic WAN). Good as some already know and others are not the 4 main types of wireless signal encryption;
1410
1411-> WEP (and its variations);
1412
1413-> WPA (and its variations);
1414
1415-> WPA2 - PSK (and its variations);
1416
1417
1418 Let's start by talking about WEP which is considered to be the worst method of encrypting passwords today, I do not know how it has not yet been extinguished. In order to be aware of the weakness of this encryption, programs that are specialized in password cracking can decrypt it in about 4 8 minutes this is due to the fact that the cipher method they used has already been discovered and deployed in the source code of these tools.
1419
1420
1421 WPA encryption is the one that comes soon after WEP, with this cryptography at the time revolutionized the market because it was considered one of the best accessible diagrams to encrypt wireless internet.This encryption was more robust with its variations that implanted various types Of encryptions and stronger methods of encryption but since nothing is perfect they have managed to discover a vulnerability to break these passwords, it is not as fast as WEP because in WPA and its variations it is necessary to reach a certain number of intercepted packets so that one can make a Bruteforce. To break your password takes about 1 to 5 hours depending on each computer and the signal strength lasts more or less.
1422
1423 After a while the WA2 encryption and its variations appeared, this method of encryption is current and therefore several today's routers use the WPA hash (encryption). This password has a very strong encryption of data traffic anyway Can be broken with a long interception of packets and traces of patterns so that one tries to assimilate the password to some standard found, due to the means of decrypting this hash the estimated time is from 4 hours to 12 hours varying from each computer and each tool can Increase or decrease time.
1424
1425
1426-> Channel
1427
1428 Many users who are worried about their gateway (WAN connection router) are looking for some information but many of them say that everything is already configured and that there is no need to change anything, there are channels from 1 to 11 if I am not mistaken, among these channels as Are signals of electromagnetic waves some can suffer interference with other objects as is the case of channel 6 that suffers shock waves between the wireless phone and the wireless signal. A channel that I recommend is channel 11 since it is practically null objects that work In this connection.
1429
1430
1431-> Cape eternet
1432
1433 The ethernet cable (in my opinion) is the best methods to connect to I.net one of the best benefits is that it can not be invaded because it does not emit electromagnetic waves to be captured and switched by the routers, another factor that also influences It is very important that it does not interfere with any object because it does not share a connection with other devices, unless you have a wired tefelone (DSL) and the ethernet cable connected to an ADSL modem (which is the most frequent) IT MAY OCCUR collisions of Packets but as the TCP protocol is anti-failures in milliseconds it will re-send the packet and you will not notice any difference in speed or traffic. Another great advantage that the ethernet cable connection provides is that its carrying capacity Of packets per second is much higher than wireless signals.
1434
1435
1436-> Restriction of MAC-Adress
1437
1438 A better gateway to router security is MAC restriction. This method consists of opening a wireless connection only to the MAC addresses of each computer, MAC address is the hexadecimal number that each network card has despite this address Being able to be cloned the attacker will have a very small chance to hit soon the MAC's that are allowed to connect in the network, with this the attacker gives up invading the network.
1439 To create this repository you must access the menu of your router, simply paste the ip of your router into the address bar (URL). If you do not know the address of your router try the defaults below:
1440
1441# 192.168.1.1
1442
1443# 192.168.0.1
1444
1445# 10.0.0.1
1446
1447# 10.1.1.1
1448
1449 If you have never connected to your router panel, I ask you to take a closer look at the subject and come and read the ezine again, but your login should probably be
1450
1451Admin admin
1452#administrator admin
1453
1454 If you are already logged in you will have to find the MAC restriction option (there's no way I can tell you that there are thousands of router models all with different configurations interfaces), when asking which MAC addresses can access the wireless signal Should go to each computer and get the MAC with the following command:
1455
1456# If it is windows go to the command prompt and type "ipconfig / all" and it will be a number similar to this 00: 00: 00: 00: 00: 00 (but not with these characters).
1457
1458
1459# If it is linux go into the shell and type "ifconfig" and it will be a number similar to this 00: 00: 00: 00: 00: 00 (but not with these characters).
1460
1461 After this is just create the rule and ready one more defense in your wireless network, ah and do not forget to change the default user and password of your router.
1462
1463
1464-> Anti-DDoS and Anti-Scan
1465
1466 With the increasing number of attacks and the increasing demand for routers, the producers place in the source code firewalls imbutidos to "facilitate" the life of the user. Among the options of the firewall of the router are to block the ICMP packages and put a maximum number of packages That they enter. There is also an option to modify the time of the package and if it exceeds this time it is discarded. I recommend that you always leave these options marked as this will be a great defense not only for your router but also for your computers that will Partially protected against some scanners.
1467
1468
1469-> DMZ (Demilitarized Zone)
1470
1471
1472
1473
1474 DMZ stands for DeMilitarized Zone, which means demilitarized zone. It is a feature that allows to make a computer fully accessible to I.net
1475
1476 When using this feature, it is not allowed to use Port Forwarding (which must be disabled). In addition, it does not only make a service accessible to the Internet, but rather all computer data can be accessed unrestrictedly, not to any kind of protection to the exposed computer.
1477
1478 It is not necessary to associate an IP port, since the computer is fully exposed. Just inform the local IP. In addition, a single computer can be configured. Access to the computer through the Internet is done by writing in the browser the public IP of the gateway.
1479
1480How to configure DMZ on the router?
1481
1482# 1. On the DMZ page, tick the itel Enable DMZ.
1483
1484
1485# 2. In DMZ Host IP Address, type the IP of the local computer that will be exposed to the Internet.
1486
1487# 3. Click Apply Changes to save the setting.
1488
1489When placing a computer in the DMZ all the doors are open. This can be used to provide services like: ftp, email, web, etc.
1490
1491 COMMENTS:
1492
1493
1494 ### A DMZ does not have firewall protection. The computers that are in the DMZ can not be protected by the firewall. They have to make sure of themselves. ###
1495
1496 ## An interesting feature is that the routers are that when placing a computer in the DMZ all "ports" are immediately opened. This can be used to provide services such as web, ftp, email. ##
1497
1498 ## AI you ask me then why leave my computer exposed? Because it will be the front-line computer or none of the other computers will be hit, just it. Whoever invades your network will have access only to the DMZ computer and to none, this is due to the fact that the DMZ is a limited zone but it has its security at zero, this is the strategy for the invader to think that it invaded your network when in fact it is stuck in a DMZ. ##
1499
1500
1501======================================
15022.6 Network monitoring - Part. II
1503======================================
1504
1505 Good people since we are talking about router security and above we have listed some tips for the security of your internal network as well as your gateway or your border between the LAN and the WAN (router). As no one likes sneaky invaders Our networks mainly if it is to sniff the frames (data) that travel there or only to get the signal and navigate quietly. If the encryption of your network is weak like the one that we present that is WEP or if its method Of data encryption is good (WPA2 and derivations) but your password is weak a simple brute force will break it.
1506
1507 If you follow the security and anonymity parameters that I and sup3rm4n are exposing both for connection on sockets (http / https) and for firewall rules, proxies for attack data redirection (ddos, scan), encryption rules and rules Restriction of the availability of frames (data) of the network for people that are not within the standards in which the MAC address is not allowed and also if it uses an ids for some unforeseen ones and for the protection of the gateways your network will be with a security already On a good level, but have you ever wondered if a well-seasoned attacker manages to circumvent all this? So you think how I will do to detect some attackers in my network.
1508
1509 Simple ! There is a tool nowadays for data monitoring that is very interesting both in its operation and in its results because they are very direct and do not express any complex information so that it is restricted to only some part of the population of passionate about information security.
1510
1511 # WEL0v3S.I (We love information security *. * // half gay this but it's good)
1512
1513 Well let's continue, the following tool that I will present to you is a kind of hping mixed with an ifconfig. That's right! They only detect the ips that are on the network and their respective MAC addresses, so you think it pow nothing too much this then.Ai that you lose;)
1514
1515 The tool is called "fing" they have compatibility with the following operating systems:
1516
1517 * Windows
1518
1519 * Linux
1520
1521 * MacOSx
1522
1523 IOs
1524
1525 Unfortunately the quick download repository does not have this tool in its database so we have to download it from the site where it was programmed:
1526
1527 Download> http://www.overlooksoft.com/download
1528
1529 Or for the lazy ones who want to download through the terminal follows the commands:
1530
1531
1532 # Wget "http://www.overlooksoft.com/packages/download?plat=lx64&ext=debâ€
1533
1534 # Sudo dpkg -i "packagename.deb"
1535
1536 After installing the fing just go to the shell terminal and type fing which will list the network you are connected to and which ips and MACs are connected.
1537 If you only have one computer on the network will appear two IPS and two MACS because they correspond to your computer (logical) and also to your router or the fing interprets your router as being a computer.If you want to know if it is even your computer that Is with that ip just go in the terminal shell and type:
1538
1539Linux: ifconfig
1540Windows: ipconfig
1541
1542 This command will list the ip and the MAC of your computer on the network. Ai it is only you compare with what is in the interface of the fing. If you only have a computer and appear 3 IPS there begin to create rules in iptables to block the unfortunate that Is invading your network and also make sure that the MAC restriction rule is enabled and configured correctly.
1543
1544==================================================
15452.7 Network monitoring - Graphical interface
1546==================================================
1547
1548 Often some people are not accustomed or do not like to be monitoring their network by command lines and for this they opt for tools that have GUI (graphical user interface) one of these examples is the Etherape that is similar to a sniffer because it intercepts The frames (data) that are going to your gateway (router), your network card and consequently your computer. The advantages of using a network traffic analyzer in GUI and command line varies from person to person To person, for example if you are in love with old desing and more hackudao then you prefer per command line, but if you prefer a more friendly tool that with a few clicks you already find out about the network traffic so your preference is about tools In general in GUI type.
1549
1550 Prefer graphics tools is not a problem but is not very recommended because most tools today in days do not care for the cute desing but for what it does for example there are scanners of cute vulnerabilities but do not have many tools and is not very open For modifications as is the example of angryscan that is used in windows as a mass scan of certain ports like (23,21,445) / 23 = telnet / 21 = ftp / 445 = windows file sharing service and also denies that Is used in linux systems and also has a GUI, the netifera is more complete than the angryscan, this is obvious not because but it seems that the best programmers have preference in command line tools and interfaces not very friendly in terms of Desing.
1551 Finally we are going to talk about etherape, it is a tool that as I said it monitors the network in real time (as I said) it has such a friendly interface that you do not need to be an expert to understand what is going on in your network card.
1552 First we must install it, fortunately has in the database of the tools download system apt-get so to download just run the following commands:
1553
1554 # Apt-get install etherape
1555
1556 # Yum install etherape
1557
1558 OR can be downloaded from the developers website >> http://etherape.sourceforge.net/
1559
1560 After this if you do not create a link in your menu just go to the terminal and type etherape.
1561
1562 Then it will open an interface that at the moment does not monitor anything because we still have to select which of the interfaces should be in "listening". Go to capture> interface and then after that select the interface you are connected to. If you do not know, just go to the Linux shell and enter the following command:
1563
1564 # Ifconfig
1565
1566 It will show you the data of your connection and your network card as well as which of the interfaces is connected but to facilitate I will give a previous explanation to facilitate the life of the lazy:
1567
1568 # If you are on a wireless connection, your interface will be "wlan0"
1569
1570 # If your internet connection is by cable (ethernet or coax) the interface used will be "eth0"
1571
1572 # There is a 3 interface that always stays on that is the "lo" that is the abbreviation of localhost, this interface makes the traffic of everything related to your computer sending to your own pc (do not understand?) Example, you go in the terminal Shell linux or at Dos prompt and type ping -a localhost. Guess who will identify who is localhost ?? The interface "lo" that is when you send an order to yourself how to ping the interface responsible is "what" .ESta doubting?
1573 Do the following put the following command in your shell command to see that what I say is true:
1574
1575 # Linux: ifconfig lo down
1576
1577 After doing this you gave a down on the "lo" interface ie you dropped this interface turned off her.Now try to give a:
1578
1579 # Ping -a localhost
1580
1581 // What's the problem ? 100% lost packets? Heheh I told you.
1582
1583 This was due to the fact that when you dropped the "lo" interface and executed the ping command directing to localhost it tries to identify the interface that is responsible for localhost management, as you dropped this interface it could not have identify and all Apocotes were lost.
1584
1585 Now to bring the interface online again:
1586
1587 Linux: ifconfig lo up
1588
1589 A tip is also to let down the interface you are using, I would not recommend leaving the "it" down. Anyway, when you select the interface to be monitored the etherape logo makes a kind of diagram with lines of different colors that grow According to the amount and intensity of connection between your machine (network card) and other service that needs to transport frames.Ell line of the etherape symbolizes a service just click on the lines that will appear the door and on the left side Of the interface will show the services that are running, and these lines vary their thickness according to the intensity of the traffic.
1590 Well, the etherape tutorial was a bit short because there is not much to talk about, so you can learn it and learn how it works, just a tip:
1591 # Do not use etherape monitoring your network while you normally browse the internet example (youtube.com, google.com and other sites) because they connect to several other servers as a connection bridge and soon your etherape will look like a disco (Tut tut tut tut).
1592
1593=========================================================
1594CRIPTOGRAPHY - Part III
1595=========================================================
15961.1 Encrypting Critical Data - Truecrypt
1597=========================================================
1598
1599 Ea galerinha;) another security related topic and this is one that I consider very important because even if an attacker goes through all these barriers that I and the sup3rm4n speak he will not be able to get his most critical data because they will be under strong Encrypted file encryption and / or even better encrypted mobile devices that can be removed and placed at any time you want without risk of someone invading your computer and stealing your data. The attacker can even be intelligent and persistent in the attack and think that As it does not have important information on the computer you may be hiding the data so it can install a keylloger on your machine and be monitoring your computer 24 hours for as soon as you decrypt your data it steals the information.But this the attacker has to be experienced and persistent.
1600 First I would like to say that a motherfucker said that it is impossible to break this truecrypt encryption and that neither the fbi as cia, federal police and nsa can not pass this security, to pass directly or try to hit head-on against a Strong encryption of the truecrypt is difficult to break, I do not say impossible, it was the Americans who invented various cryptographic methods and algorithms.
1601 An example of encryption that is very strong and used in all data traffic on the internet mainly in e-commerce sites is RSA encryption which can be summarized by the mathematical formula n = pq this formula seems very simple but the public key numbers And private are huge prime numbers.
1602
1603 # Let's encrypt them as truecrypt option: (Note: Information taken from the truecrypt site documentation: www.truecrypt.org/docs/)
1604
1605
1606
1607 ## AES:
1608
1609
1610 The Advanced Encryption Standard (AES) specifies a FIPS - approved encryption algorithm (Rijndael, designed by Joan Daemen and Vincent Rijmen, published in 1998), which can be used by US federal departments and agencies to protect cryptographically sensitive information. TrueCrypt uses AES with 14 rounds and a 256-bit key (that is, AES-256, published in 2001) operating in XTS mode.
1611
1612In June 2003, after the NSA conducted a review and analysis of AES, the US CNSS (National Security Systems Committee) announced that the design and strength of AES-256 (and AES- 192) are sufficient to protect classified information up to the Top Secret level. This is applicable to all US government departments or agencies that are considering the purchase or use of products that incorporate the Advanced Encryption Standard (AES) to meet the information security requirements associated with the protection of national security systems and / Or national security information.
1613
1614
1615 ## Serpent:
1616
1617 Designed by Ross Anderson, Eli Biham and Lars Knudsen, published in 1998. It uses a 256-bit, 128-bit key and operates in XTS mode. Snake was one of the AES finalists. It was not selected as the proposed AES algorithm, even though it appeared to have a higher margin of safety than the winning Rijndael. More concretely, Serpent seemed to have a high safety margin, while Rijndael seemed to have only an adequate margin of safety. Rijndael also received some criticism suggesting that his mathematical structure may lead to attacks in the future.
1618
1619 The Twofish Crypto presents a table of safety factors for AES finalists. Security factor is defined as: number of rounds of the complete cipher divided by the highest number of rounds that was broken. Thus, a broken cipher has the smallest security factor 1. Snake had the highest safety factor of the AES finalists: 3.56 (for all supported key sizes). Rijndael-256 had a safety factor of 1.56.
1620
1621Despite these facts, Rijndael was considered a suitable selection for AES for its combination of safety, performance, efficiency, feasibility and flexibility. At the last AES Candidate Conference, Rijndael has 86 votes, Serpent has 59 votes, Twofish has 31 votes, RC6 has 23 votes, and MARS has 13 votes.
1622
1623
1624 ## Twofish:
1625
1626 Designed by Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson, published in 1998. It uses a 256-bit key and 128-bit blocks and operates in XTS mode. Twofish was one of the AES finalists. This figure uses the key dependent S-boxes. Twofish can be viewed as a set of different 2128 encryption systems, where 128 bits from a 256-bit derivative control key encryption system selection. In, the Twofish team claims that the key dependent on S-boxes constitute a form of margin of safety against unknown attacks.
1627
1628
1629 ## RIPMD-160:
1630
1631 RIPEMD-160, published in 1996, is a hash algorithm designed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel in an open academic community. The size of the RIPEMD-160 output is 160 bits. RIPEMD-160 is an enhanced version of the RIPEMD hash algorithm that was developed under the RIPE project of the European Union (RACE Integrity Primitives Evaluation), 1988-1992. RIPEMD-160 was adopted by the International Organization for Standardization (ISO) and IEC 10118-3: 2004 in the international standard ISO / IEC
1632
1633
1634 ## SHA-512:
1635
1636 SHA-512 is a hash algorithm designed by the NSA and published by NIST in FIPS PUB 180-2 [14] in 2002 (the first version was published in 2001). The output size of this algorithm is 512 bits.
1637
1638 ## Whirlpoor:
1639
1640 The Whirlpool hash algorithm was designed by Vincent Rijmen (co-creator of the AES encryption algorithm) and Paulo SLM Barreto. The output size of this algorithm is 512 bits. The first version of Whirlpool, now called Whirlpool-0, was published in November 2000. The second version, now called Whirlpool-T, was selected for the NESSIE (new European schemes for signatures, integrity and cryptography) portfolio of cryptographic primitives (A project organized by the European Union, similar to the AES competition). TrueCrypt uses the third (final) version of Whirlpool, which was approved by the International Organization for Standardization (ISO) and IEC 10118-3: 2004 in the international ISO / IEC standard.
1641
1642
1643 -> There are encryption merge in order to strengthen the encryption method of the data to be protected, the encryptions that were created by the encryption merge are:
1644
1645
1646
1647 ## AES- Twofish:
1648
1649Two digits in a cascade operating in XTS mode. Each 128-bit block is first encrypted with Twofish (256-bit key) in XTS mode and then with AES (256-bit key) in XTS mode. Each of the cascade digits uses its own key. All encryption keys are independent of each other (note that the header keys are too independent, even if they are derived from a single password - see Derivation Header key, Salt, and iteration count). See above for information on individual cascading figures.
1650
1651 ## AES-Twofish-Serpent:
1652
1653Three digits in a cascade operating in XTS mode. Each 128-bit block is the first encrypted with Serpent (256-bit key) in XTS mode, then with Twofish (256-bit key) in XTS mode, and finally with AES (256-bit key) in XTS mode. Each of the cascade digits uses its own key. All encryption keys are independent of each other (note that the header keys are too independent, even if they are derived from a single password - refer to the section Header Derivation, Salt, and iteration counting). See above for information on individual cascading figures.
1654
1655 ## Serpent -AES:
1656
1657Two digits in a cascade operating in XTS mode. Each 128-bit block is the first one encrypted with AES (256-bit key) in XTS mode and then with Serpent (256-bit key) in XTS mode. Each of the cascade digits uses its own key. All encryption keys are independent of each other (note that the header keys are too independent, even if they are derived from a single password - see the Derivation Header, Key, Salt, and Iteration Count section). See above for information on individual cascading figures.
1658
1659 ## Serpent-Twofish-AES:
1660
1661Three digits in a cascade operating in XTS mode. Each 128-bit block is the first one encrypted with AES (256-bit key) in XTS mode, then with Twofish (256-bit key) in XTS mode, and finally with the Snake (256-bit key) in XTS mode. Each of the cascade digits uses its own key. All encryption keys are independent of each other (note that the header keys are too independent, even if they are derived from a single password - refer to the section Header Derivation, Salt, and iteration counting). See above for information on individual cascading figures.
1662
1663 ## Twofish-Serpent:
1664
1665Two digits in a cascade operating in XTS mode. Each 128-bit block is the first encrypted with Serpent (256-bit key) in XTS mode and then with Twofish (256-bit key) in XTS mode. Each of the cascade digits uses its own key. All encryption keys are independent of each other (note that the header keys are too independent, even if they are derived from a single password - refer to the section Header Derivation, Salt, and iteration counting).
1666
1667
1668
1669 -> So after getting a few more critical in regards to encryption standards we will first create a hidden encrypted file in truecrypt. But first we should download it from the developer site >> http://www.truecrypt.org/ Downloads
1670 Truecrypt supports the following operating systems:
1671
1672 Windows
1673
1674 # IOS / Mac
1675
1676 # Linux
1677
1678 After downloading this tool install normally, then let's the first step to create an encrypted hidden file:
1679
1680 1- Open truecrypt.
1681
1682 2- Will open the truecrypt interface that is very easy to move because it is GUI (user interface) very user friendly.
1683
1684 3- Click "Create volume" and select "Create an encrypted file container"
1685
1686 4- Select the option you want "Standard TrueCrypt volume" to unseen file and "Hidden TrueCrypt volume" to create hidden file, I recommend the second option.
1687
1688 5 - Select the "Never save history" option and after that click on "Select File" after this select the name that you want and click Next.
1689
1690 6 - Based on our above cryptography studies, you should choose the "Encryption Algorithm" and the "Hash Algorithm" and click Next.
1691
1692 7- Select the size you want your file to store, for example: if you select a file of 50 gigabytes and the encrypted file will store about 50 gigabytes of data.
1693
1694 8- Select Next and then select the password you want, I recommend using a large password and difficult to understand tools like brute force.Click Next.
1695
1696 9- Now click on "Format" and wait for the process to finish, when everything is done close the window.
1697
1698You have already created your encrypted (or not, depending on your choice) hidden file. Now let's access this file to store my critical data such as bank passwords, or logins.
1699
1700 1- Open truecrypt in its initial interface.
1701
1702 2- Click "Select File" and select the file you created.
1703
1704 3- Enter the password and shortly after informing, wait a moment and then it will appear on your desktop a file link for storing files that you want in your encrypted file.
1705
1706 4- If you want to navigate normally just click on exit in truecrypt and every time you want to arm the file, simply drag to the icon that will be on the desktop.
1707
1708 5. At the time you want to encrypt your file again (I recommend whenever you save what you have to save, decrypt it at the same time) Just click on the icon that will be minimized in the corner of your screen where the small icons of applications.
1709
1710 6 - The Truecrypt interface will appear again, so just click on "Dismount All" and then click on exit.
1711
1712 7- You have already stored your data securely and closed your encrypted file.
1713
1714 8- Remember, every time you want to open the encrypted file follow the steps mentioned above (except the hehehe creation).
1715
1716
1717====================================================================== ======================
17181.2 To the Smart Boys, if you connect with PF, hit it ... FUDEU! - Destroying data.
1719====================================================================== ======================
1720
1721 Everyone knows that just clicking delete with the "del" key does not destroy a 2 gbs file of pure database that you just downloaded from an important site in 10 seconds, so you do this and you are happy because you invaded a site, downloaded The database just forgot to delete the logs but then you think,
1722
1723 - no problem if I get the database will be deleted and will not have evidence against me.
1724 Dear friend, sorry for the expression but you are dumb.
1725
1726 # First, how do you delete a 2gbs file of pure information that will chill you in 10 seconds?
1727
1728 # Second, never leave the logs behind they may lead to you.
1729
1730 But okay the feds come to your house and you as you think they will not have evidence against you, they pick up your computer and in 10 minutes with a tool that retrieves information, that after all this type of tool is very used by forensic analysis.There are divesos Programs for data recovery, a simple google search takes us to many tools.Therefore you have to be very careful when deleting crucial information that may be imputed to you, I will show you two tools that can do the "dirty work" for you:
1731
1732 ## Wipe
1733
1734 ## shred
1735
1736
1737=========
17381.3 WIPE
1739=========
1740
1741
1742 The wipe is a tool made in command line that serves to deface a file about 34 times replacing both its internal characters and the characters of the title making this process about 34 times. Before we download it, it is in the repositories of Quick download of ubuntu as apt-get, so to install this tool just run the command:
1743
1744 # Apt-get install wipe
1745
1746
1747 I recommend creating a folder called garbage and take all the important information to there just after the end of the day (or when you feel like it) just go to the shell terminal and type:
1748
1749 # Wipe -fr "folder name"
1750
1751 Here are some options that can be found using the command: wipe -h (OBS: They are in English)
1752
1753Options:
1754 -a Abort on error
1755 -b <buffer-size-lg2> Set the size of the individual i / o buffers
1756 By specifying its logarithm in base 2. Up to 30 of these
1757 Buffers might be allocated
1758 -c Do a chmod () on write-protected files
1759 -D Dereference symlinks (conflicts with -r)
1760 -e Use exact file size: do not round up file size to wipe
1761 Possible junk remaining on the last block
1762 -f Force, ie do not ask for confirmation
1763 -F Do not attempt to wipe filenames
1764 -h Display this help
1765 -i Informative (verbose) mode
1766 -k Keep files, ie do not remove () them after overwriting
1767 -l <length> Set wipe length to <length> bytes, where <length> is
1768 An integer followed by K (Kilo: 1024), M (Mega: K ^ 2) or
1769 G (Giga: K ^ 3)
1770 -M (l | r) Set PRNG algorithm for filling blocks (and ordering passes)
1771 L Use libc's random () library call
1772 A Use arcfour encryption algorithm
1773 -o <offset> Set wipe offset to <offset>, where <offset> has the
1774 Same format as <length>
1775 -P <passes> Set number of passes for filename wiping.
1776 Default is 1.
1777 -Q <number> set number of passes for quick wipe
1778 -q Quick wipe, less secure, 4 random passes by default
1779 -r Recurse into directories - symlinks will not be followed
1780 -R Set random device (or random seed command with -S c)
1781 -S (r | c | p) Random seed method
1782 R Read from random device (strong)
1783 C Read from output of random seed command
1784 P Use pid (), clock (), etc. (Weakest)
1785 -s Silent mode - suppresses all output
1786 -T <tries> Set maximum number of tries for free
1787 Filename search; Default is 10
1788 -v Show version information
1789 -Z Do not attempt to wipe f ile size
1790
1791
1792
1793
1794======================================
17951.4 Script to clear All Logs
1796======================================
1797
1798
1799 Below is a script to clear all the logs that exist in the operating system.
1800
1801 OBS:
1802
1803 ## First: In the tool you must select to download the wipe (necessary for tool operation)
1804
1805 ## Second: If you depend on any log of the system do not use this tool because it disfigures any and all logs that exist in the system.
1806
1807 ## Terceito: Beware of using it if you have any log-based tools, the use of the script can permanently damage it.
1808
1809
1810
1811
1812 ************************************************** ************************************************** ***************
1813
1814#! / Bin / sh
1815
1816#Script BY: Uid0 V 2.0
1817Echo -e '\ e [32; 1mScript BY: Uid0 // Version 2.0 \ e [m'
1818Echo
1819 .
1820 _ / _--- ()
1821 Eur-lex.europa.eu eur-lex.europa.eu
1822 ==== - Bye Bye Babys --- === ;;;
1823 \ / V 2.0
1824 Eur-lex.europa.eu eur-lex.europa.eu
1825 (I.e.
1826 Eur-lex.europa.eu eur-lex.europa.eu
1827 I;
1828 Eur-lex.europa.eu eur-lex.europa.eu
1829 KBUM ..... ((((^ -))))
1830 -------------------------------------------------- ----------------
18311- Download wipe (necessary to clear log).
18322- Clone MAC
18333- Internal ip camouflage.
18344- Clear logs.
18355- Exit
1836'
1837
1838Read menu
1839
1840If [$ Menu -eq 1]; Then
1841 Sudo apt-get -y install wipe
1842 Clear
1843 Echo -e '\ e [32; 1mComplete. Press ENTER to return to the Menu. \ E [m'
1844 Read
1845Clear
1846./script.sh
1847Fi
1848
1849If [$ Menu -eq 2]; Then
1850 Ifconfig wlan0 down
1851 Ifconfig wlan0 hw ether 16: cd: 26: ab: 69: ef # 40: 3a: 05: 96: 5a: 10
1852 Ifconfig wlan0 up
1853 Clear
1854 Echo -e '\ e [32; 1mComplete. Press ENTER to return to the Menu. \ E [m'
1855Read
1856Clear
1857./script.sh
1858Fi
1859
1860If [$ Menu -eq 3]; Then
1861 Ifconfig wlan0 down
1862 Ifconfig wlan0: 1 55.23.21.3
1863 Ifconfig wlan0: 1: 2 90.76.45.2
1864 Ifconfig wlan0: 1: 2: 3 192.33.23.57
1865 Ifconfig wlan0: 1: 2: 3: 4 87,239,211.23
1866 Ifconfig wlan0: 1: 2: 3: 4: 5 97.45.31.174
1867 Ifconfig wlan0 up
1868 Clear
1869 Echo -e '\ e [32; 1mComplete. Press ENTER to check the network config. \ E [m'
1870 Read
1871Clear
1872Ifconfig
1873 Echo -e '\ e [32; 1mPress ENTER to exit \ e [m'
1874Read
1875Clear
1876./script.sh
1877Fi
1878
1879If [$ Menu -eq 4]; Then
1880Clear
1881 Echo -e '\ e [32; 1mCleaning Logs \ and [m'
1882
1883Wipe -fr /root/.cache/*
1884
1885Wipe -fr /root/.bash_history
1886
1887History -c
1888
1889Wipe -fr / var / log / *
1890
1891Wipe -f /var/lib/texmf/web2c/pdftex/pdftex.log
1892
1893Wipe -f /var/lib/texmf/web2c/pdftex/pdfetex.log
1894
1895Wipe -f /var/lib/texmf/web2c/pdftex/latex.log
1896
1897Wipe -f /var/lib/texmf/web2c/pdftex/pdflatex.log
1898
1899Wipe -f /var/lib/texmf/web2c/pdftex/etex.log
1900Clear
1901Echo -e '\ e [32; 1m5% complete \ e [m'
1902Wipe -f /var/lib/texmf/web2c/updmap.log
1903
1904Wipe -f /var/lib/texmf/web2c/metafont/mf.log
1905
1906Wipe -f /var/lib/texmf/web2c/luatex/lualatex.log
1907
1908Wipe -f /var/lib/texmf/web2c/luatex/luatex.log
1909
1910Wipe -f /var/lib/texmf/web2c/luatex/dviluatex.log
1911
1912Wipe -f /var/lib/texmf/web2c/luatex/dvilualatex.log
1913
1914Wipe -f /var/lib/texmf/web2c/tex/tex.log
1915
1916Wipe -f /var/lib/gems/1.8/gems/mongrel-1.1.5/ext/http11/mkmf.log
1917
1918Wipe -f /var/lib/gems/1.8/gems/erubis-2.7.0/test/data/users-guide/stderr.log
1919Clear
1920Echo -e '\ e [32; 1m10% complete \ e [m'
1921Wipe -f /var/lib/gems/1.8/gems/bson_ext-1.3.0/ext/cbson/mkmf.log
1922
1923Wipe -f /var/lib/gems/1.8/gems/do_sqlite3-0.10.5/ext/do_sqlite3/mkmf.log
1924
1925
1926Wipe -f /var/lib/gems/1.8/gems/sqlite3-ruby-1.3.2/ext/sqlite3/mkmf.log
1927
1928Wipe -f /var/lib/gems/1.8/gems/erubis-2.6.6/test/data/users-guide/stderr.log
1929
1930Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
1931
1932Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
1933
1934Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
1935
1936Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
1937
1938Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
1939Clear
1940Echo-e '\ e [32; 1m15% complete \ e [m'
1941Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
1942
1943Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
1944
1945Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
1946
1947Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
1948
1949Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/ext/json/ext/parser/mkmf.log
1950
1951Wipe -f /var/lib/gems/1.8/gems/json-1.5.3/ext/json/ext/generator/mkmf.log
1952
1953Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
1954
1955Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
1956
1957Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
1958
1959Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
1960
1961Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
1962
1963Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
1964Clear
1965Echo -e '\ e [32; 1m20% complete \ e [m'
1966Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
1967
1968Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
1969
1970Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
1971
1972Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/ext/json/ext/parser/mkmf.log
1973
1974Wipe -f /var/lib/gems/1.8/gems/json-1.5.1/ext/json/ext/generator/mkmf.log
1975
1976Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
1977
1978Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
1979
1980Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
1981
1982Wipe -f /var/log/boot.log
1983
1984Wipe -f /var/log/netconf.log
1985
1986Wipe -f /pentest/wireless/fern-wifi-cracker/capture_status.log
1987
1988Wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
1989
1990Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / raidcall_7.2.8.log
1991
1992Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / proto_7.2.8.log
1993
1994Wipe -f /root/.local/share/gvfs-metadata/trash:-358b295d.log
1995
1996Wipe -f /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-7e93f4cd.log
1997
1998Wipe -f /root/ .local/share/gvfs-metadata/archive:host=file%253A%252F%252F%252Ftmp%252Fperl1.zip-034aedeb.log
1999
2000Wipe -f /root/.local/share/gvfs-metadata/uuid-ef9aea92-fcde-46b1-a03b-e116fd5cd939-07aceae2.log
2001
2002Wipe -f /root/.local/share/gvfs-metadata/root-8e25cce9.log
2003
2004Wipe -f /root/.local/share/gvfs-metadata/home-0cd48961.log
2005
2006Wipe -f /root/.local/share/gvfs-metadata/archive:host=file%253A%252F%252F%252Ftmp%252F404.zip-aaa48186.log
2007
2008Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2009
2010Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2011
2012Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2013Clear
2014Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2015
2016Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2017
2018Wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2019
2020Wipe -f /var/lib/gems/1.8/gems/hpricot-0.8.4/ext/fast_xs/mkmf.log
2021
2022Wipe -f /var/lib/gems/1.8/gems/hpricot-0.8.4/ext/hpricot_scan/mkmf.log
2023
2024Wipe -f /var/lib/gems/1.8/gems/ffi-1.0.11/ext/ffi_c/libffi/config.log
2025
2026Wipe -f /var/lib/gems/1.8/gems/ffi-1.0.11/ext/ffi_c/mkmf.log
2027
2028Wipe -f /var/lib/gems/1.8/gems/fxruby-1.6.22/ext/fox16/mkmf.log
2029
2030Wipe -f /var/lib/gems/1.8/gems/bson_ext-1.5.2/ext/cbson/mkmf.log
2031
2032Wipe -f /var/lib/gems/1.9.2/gems/eventmachine-0.12.10/ext/mkmf.log
2033
2034Wipe -f /var/lib/gems/1.9.2/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2035Clear
2036Echo -e '\ e [32; 1m27% complete \ e [m'
2037Wipe -f /var/lib/gems/1.9.2/gems/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2038
2039Wipe -f /var/lib/gems/1.9.2/gems/gems/do_sqlite3-0.10.8/ext/do_sqlite3/mkmf.log
2040
2041Wipe -f /var/lib/gems/1.9.2/gems/gems/sqlite3-1.3.5/ext/sqlite3/mkmf.log
2042
2043Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
2044
2045Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
2046
2047Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
2048
2049Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2050
2051Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2052
2053Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2054
2055Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2056
2057Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2058
2059Wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2060
2061Wipe -f /var/lib/gems/1.9.2/gems/msgpack-0.5.5/ext/msgpack/mkmf.log
2062
2063Wipe -f /var/lib/gems/1.9.2/gems/mysql-2.8.1/ext/mysql_api/mkmf.log
2064
2065Wipe -f /var/lib/gems/1.9.2/gems/hpricot-0.8.6/ext/fast_xs/mkmf.log
2066Clear
2067Wipe -f /var/lib/gems/1.9.2/gems/hpricot-0.8.6/ext/hpricot_scan/mkmf.log
2068
2069Wipe -f /var/lib/gems/1.9.2/gems/nokogiri-1.4.4/ext/nokogiri/mkmf.log
2070
2071Wipe -f /var/lib/gems/1.9.2/gems/erubis-2.6.6/test/data/users-guide/stderr.log
2072
2073Wipe -f /var/lib/gems/1.9.2/gems/do_sqlite3-0.10.13/ext/do_sqlite3/mkmf.log
2074
2075Wipe -f /var/lib/gems/1.9.2/gems/mysql-2.9.1/ext/mysql_api/mkmf.log
2076
2077Wipe -f /var/lib/gems/1.9.2/gems/thin-1.5.1/ext/thin_parser/mkmf.log
2078
2079Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
2080
2081Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
2082
2083Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
2084
2085Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2086
2087Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2088
2089Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2090Clear
2091Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2092
2093Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2094
2095Wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2096
2097Wipe -f /var/lib/gems/1.9.2/gems/fxruby-1.6.25/ext/fox16/mkmf.log
2098
2099Wipe -f /var/lib/gems/1.9.2/gems/ffi-1.0.11/ext/ffi_c/libffi/config.log
2100
2101Wipe -f /var/lib/gems/1.9.2/gems/ffi-1.0.11/ext/ffi_c/mkmf.log
2102
2103Wipe -f /var/lib/gems/1.9.2/gems/sqlite3-ruby-1.2.5/ext/sqlite3_api/mkmf.log
2104Clear
2105Echo -e '\ e [32; 1m36% complete \ e [m'
2106Wipe -f /var/lib/gems/1.9.2/gems/bson_ext-1.5.2/ext/cbson/mkmf.log
2107
2108Wipe -f /var/lib/gems/1.9.2/gems/RedCloth-4.2.5/ext/redcloth_scan/mkmf.log
2109
2110Wipe -f /usr/share/doc/openjdk-6-jre-headless/test-i386/mauve_output-hotspot.log
2111
2112Wipe -f /usr/share/doc/openjdk-6-jre-headless/test-i386/jtreg-summary-hotspot.log
2113
2114Wipe -f /usr/share/doc/openjdk-6-jre-headless/test-i386/mauve_output-zero.log
2115
2116Wipe -f /usr/share/doc/openjdk-6-jre-headless/test-i386/jtreg-summary-zero.log
2117
2118Wipe -f /usr/share/subterfuge/httpall.log
2119
2120Wipe -f /usr/share/subterfuge/sslstrip.log
2121
2122Wipe -f /usr/local/etc/raddb/modules/detail.log
2123Clear
2124Wipe -f /opt/framework/postgresql/postgresql.log
2125
2126Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/eventmachine-0.12.10/ext/mkmf.log
2127
2128Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/pg-0.11.0/ext/mkmf.log
2129
2130Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.3/ext/nokogiri/mkmf.log
2131
2132Wipe -fr /pentest/exploits/set/src/logs/set_logfile.log
2133
2134Wipe -fr /pentest/web/sslstrip/sslstrip.log
2135
2136Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/mysql-2.8.1/ext/mysql_api/mkmf.log
2137
2138Wipe -fr /var/log/boot.log
2139
2140Wipe -fr /var/log/netconf.log
2141
2142Wipe -fr /pentest/web/sslstrip/sslstrip.log
2143
2144Wipe -fr /pentest/exploits/set/src/logs/set_logfile.log
2145
2146Wipe -fr /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2147
2148Wipe -fr /root/.wine/drive_c/users/root/Application Data / raidcall / log / raidcall_7.2.8.log
2149
2150Wipe -fr /root/.wine/drive_c/users/root/Application Data / raidcall / log / proto_7.2.8.log
2151
2152Wipe -fr /root/.local/share/gvfs-metadata/trash:-457bed85.log
2153
2154Wipe -fr /root/.local/share/gvfs-metadata/uuid-ef9aea92-fcde-46b1-a03b-e116fd5cd939-ba502239.log
2155
2156Wipe -fr /root/.local/share/gvfs-metadata/home-8fd623a1.log
2157
2158Wipe -fr /root/.local/share/gvfs-metadata/root-b32c0d1e.log
2159
2160Wipe -fr /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-2e18e11a.log
2161
2162Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/activerecord-2.3.5/test/assets/example.log
2163
2164Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
2165
2166Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
2167
2168Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
2169
2170Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2171
2172Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2173
2174Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2175Clear
2176Echo -e '\ e [32; 1m40% complete \ e [m'
2177Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2178
2179Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2180
2181Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2182
2183Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/activeresource-2.3.5/test/debug.log
2184
2185Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/rails-2.3.5/configs/empty.log
2186
2187Wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/thin-1.2.7/ext/thin_parser/mkmf.log
2188
2189Wipe -f /opt/framework/msf3/external/source/vncdll/winvnc/libjpeg/change.log
2190
2191Wipe -f /opt/framework/msf3/external/source/meterpreter/source/jpeg-8/change.log
2192
2193Wipe -f /opt/metasploit/apps/pro/nginx/logs/error.log
2194
2195Wipe -f /opt/metasploit/apps/pro/nginx/logs/access.log
2196Clear
2197Wipe -f /opt/metasploit/apps/pro/nginx/logs/rpc.log
2198
2199Wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/pg-0.13.2/ext/mkmf.log
2200
2201Wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2202
2203Wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/after_commit_queue-1.0.1/test/dummy/log/test.log
2204
2205Wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/after_commit_queue-1.0.1/test/dummy/log/development.log
2206
2207Wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2208Clear
2209Wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/network_interface-0.0.1/ext/network_interface_ext/mkmf.log
2210
2211Wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/bundler/gems/pcaprub-8f11633e459a/ext/pcaprub/mkmf.log
2212
2213Wipe -f /opt/metasploit/apps/pro/ui/tmp/pids/delayed_job.log
2214
2215Wipe -f /opt/metasploit/apps/pro/ui/log/production.log
2216
2217Wipe -f /opt/metasploit/apps/pro/ui/log/delayed_job.log
2218Clear
2219Echo -e '\ e [32; 1m57% complete \ e [m'
2220Wipe -f /opt/metasploit/apps/pro/ui/log/thin.log
2221
2222Wipe -f /opt/metasploit/apps/pro/engine/prosvc_stdout.log
2223
2224Wipe -f /opt/metasploit/apps/pro/engine/license.log
2225
2226Wipe -f /opt/metasploit/apps/pro/engine/prosvc_stderr.log
2227
2228Wipe -f /opt/metasploit/apps/pro/engine/log/production.log
2229
2230Wipe -f /opt/metasploit/apps/pro/engine/config/logs/framework.log
2231
2232Wipe -f /opt/metasploit/apps/pro/data/vulndex/vulndex.log
2233
2234Wipe -f /opt/metasploit/postgresql/postgresql.log
2235
2236Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/eventmachine-1.0.3/ext/mkmf.log
2237
2238Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/thin-1.5.1/ext/thin_parser/mkmf.log
2239
2240Wipe -f /root/.gem/ruby/1.9.2/gems/unf_ext-0.0.6/ext/unf_ext/mkmf.log
2241
2242Wipe -f /root/.gem/ruby/1.9.2/gems/typhoeus-0.2.4/ext/typhoeus/mkmf.log
2243Clear
2244Echo -e '\ e [32; 1m58% complete \ e [m'
2245Wipe -f /root/.gem/ruby/1.9.2/gems/ffi-1.9.0/ext/ffi_c/mkmf.log
2246
2247Wipe -f /root/.gem/ruby/1.9.2/gems/ffi-1.9.0/ext/ffi_c/libffi-i486-linux/config.log
2248
2249Wipe -f /root/.gem/ruby/1.9.2/gems/fxruby-1.6.28/ext/fox16_c/mkmf.log
2250
2251Wipe -f /root/.gem/ruby/1.9.2/gems/typhoeus-0.3.3/ext/typhoeus/mkmf.log
2252
2253Wipe -f /root/.msf4/logs/framework.log
2254
2255Wipe -f /root/.local/share/Trash/files/search.log
2256Clear
2257Echo -e '\ e [32; 1m60% complete \ e [m'
2258Wipe -f /root/.local/share/gvfs-metadata/home-eb800cf1.log
2259
2260Wipe -f /root/.local/share/gvfs-metadata/network:-23dd4af9.log
2261
2262Wipe -f /root/.local/share/gvfs-metadata/trash:-cd593053.log
2263
2264Wipe -f /root/.local/share/gvfs-metadata/root-44ef9687.log
2265
2266Wipe -f /root/.local/share/gvfs-metadata/http:uri=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D82V1YOdoD5Q-dc47b835.log
2267
2268Wipe -f /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-527992a1.log
2269Clear
2270Echo -e '\ e [32; 1m65% complete \ e [m'
2271Wipe -f /root/.local/share/gvfs-metadata/uuid-f5987f60-4fd5-4558-aa44-d196a3e9e61b-abfcb32f.log
2272
2273Wipe -f /root/teamviewer8/logfiles/TeamViewer8_Logfile.log
2274
2275Wipe -f /root/teamviewer8/logfiles/startup.log
2276
2277Wipe -f /pentest/reverse-engineering/javasnoop/js.log
2278
2279Wipe -f /pentest/reverse-engineering/binwalk/file-5.07/config.log
2280
2281Wipe -f /pentest/reverse-engineering/binwalk/config.log
2282
2283Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/devirt/devirt.log
2284Clear
2285Echo -e '\ e [32; 1m70% complete \ e [m'
2286Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/sideeffect/images.log
2287
2288Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/sideeffect/sideeffect.log
2289
2290Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/profiler2/profiler2.log
2291
2292Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/useannotation/useannotation.log
2293
2294Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/profiler/profiler.log
2295
2296Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/jimpleParser/jimpleParser.log
2297Clear
2298Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/shimple/shimple.log
2299
2300Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/phase/phase.log
2301
2302Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/phase/images.log
2303
2304Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/faq/faq.log
2305
2306Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/usage/usage.log
2307
2308Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/intro/images.log
2309Clear
2310Echo -e '\ e [32; 1m85% complete \ e [m'
2311Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/intro/intro.log
2312
2313Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/optimizer/optimizer.log
2314
2315Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/tagclass/tagclass.log
2316
2317Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/createclass/createclass.log
2318
2319Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/addattributes/addattributes.log
2320
2321Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/analysis/images.log
2322
2323Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/analysis/analysis.log
2324
2325Wipe -f /var/log/boot.log
2326
2327Wipe -f /var/log/netconf.log
2328
2329Wipe -f /opt/metasploit/msf3/external/source/vncdll/winvnc/libjpeg/change.log
2330
2331Wipe -f /opt/metasploit/msf3/external/source/meterpreter/source/jpeg-8/change.log
2332
2333Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2334
2335Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/pg-0.13.2/ext/mkmf.log
2336
2337Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/thin-1.3.1/ext/thin_parser/mkmf.log
2338
2339Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2340
2341Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/eventmachine-0.12.10/ext/mkmf.log
2342
2343Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/pg-0.13.2/ext/mkmf.log
2344
2345Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/thin-1.3.1/ext/thin_parser/mkmf.log
2346
2347Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2348
2349Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/eventmachine-0.12.10/ext/mkmf.log
2350
2351Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/win32/pg-0.13.2/ext/mkmf.log
2352
2353Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/win32/eventmachine-1.0.0.beta.4/ext/fastfilereader/mkmf.log
2354
2355Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/win32/eventmachine-1.0.0.beta.4/ext/mkmf.log
2356
2357Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch-old/linux32/pg-0.13.2/ext/mkmf.log
2358
2359Wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch-old/linux64/pg-0.13.2/ext/mkmf.log
2360
2361Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2362
2363Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/pg-0.13.2/ext/mkmf.log
2364
2365Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/thin-1.3.1/ext/thin_parser/mkmf.log
2366
2367Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2368
2369Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/eventmachine-0.12.10/ext/mkmf.log
2370
2371Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/pg-0.13.2/ext/mkmf.log
2372
2373Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/thin-1.3.1/ext/thin_parser/mkmf.log
2374
2375Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2376
2377Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/eventmachine-0.12.10/ext/mkmf.log
2378
2379Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/win32/pg-0.13.2/ext/mkmf.log
2380Echo -e '\ e [32; 1m90% complete \ e [m'
2381Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/win32/eventmachine-1.0.0.beta.4/ext/fastfilereader/mkmf.log
2382
2383Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/win32/eventmachine-1.0.0.beta.4/ext/mkmf.log
2384
2385Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch-old/linux32/pg-0.13.2/ext/mkmf.log
2386
2387Wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch-old/linux64/pg-0.13.2/ext/mkmf.log
2388
2389Wipe -f /opt/metasploit/apps/pro/engine/config/logs/db.log
2390
2391Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2392
2393Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
2394
2395Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
2396
2397Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2398
2399Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2400
2401Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2402
2403Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2404
2405Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
2406
2407Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2408
2409Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/bson_ext-1.6.1/ext/cbson/mkmf.log
2410
2411Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/pg-0.13.2/ext/mkmf.log
2412
2413Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/thin-1.3.1/ext/thin_parser/mkmf.log
2414
2415Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2416
2417Wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/eventmachine-0.12.10/ext/mkmf.log
2418
2419Wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2420
2421Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / raidcall_7.2.8.log
2422
2423Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / proto_7.2.8.log
2424
2425Wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2426
2427Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / raidcall_7.2.8.log
2428
2429Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / proto_7.2.8.log
2430
2431Wipe -f /root/.local/share/gvfs-metadata/home-7502e7d1.log
2432
2433Wipe -f /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-5fd768bc.log
2434
2435Wipe -f /root/.local/share/gvfs-metadata/root-35067688.log
2436
2437Wipe -f / root / .local / share / gvfs-metadata / uuid-ef9aea92-fcde-46b1-a03b-e116fd5cd939-711cb91a.log
2438
2439Wipe -f / root / .local / share / gvfs-metadata / home-36b4085d.log
2440
2441Wipe -f / root / teamviewer8 / logfiles / TeamViewer8_Logfile_OLD.log
2442
2443Wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/menagerie/menagerie.log
2444
2445Wipe -f /pentest/fuzzers/rfuzz/gems/rfuzz-0.9/ext/http11_client/mkmf.log
2446Clear
2447Wipe -f /pentest/fuzzers/rfuzz/gems/rfuzz-0.9/ext/fuzzrnd/mkmf.log
2448
2449Wipe -f /pentest/fuzzers/rfuzz/gems/mongrel-1.1.5/ext/http11/mkmf.log
2450
2451Wipe -f /pentest/fuzzers/spike/src/config.log
2452
2453Wipe -f /pentest/misc/exiftool/t/images/Geotag.log
2454
2455Wipe -f /var/log/boot.log
2456
2457Wipe -f /var/log/netconf.log
2458
2459Wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2460
2461Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / raidcall_7.2.8.log
2462
2463Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / proto_7.2.8.log
2464
2465Wipe -f /root/.local/share/gvfs-metadata/uuid-ef9aea92-fcde-46b1-a03b-e116fd5cd939-711cb91a.log
2466
2467Wipe -f /root/.local/share/gvfs-metadata/home-af94a79f.log
2468
2469Wipe -f /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-d99053da.log
2470
2471Wipe -f /root/teamviewer8/logfiles/TeamViewer8_Logfile_OLD.log
2472
2473Wipe -f /pentest/misc/exiftool/t/images/Geotag2.log
2474
2475Wipe -f /pentest/sniffers/darkstat/config.log
2476
2477Wipe -f /pentest/telephony/warvox/src/ruby-kissfft/mkmf.log
2478
2479Wipe -f /pentest/telephony/warvox/web/log/production.log
2480Clear
2481Wipe -f /pentest/web/owasp-zap/db/zapdb.log
2482
2483Wipe -f /pentest/web/dirb/config.log
2484
2485Wipe -f /pentest/voip/artemisa/logs/artemisa_pjsua_2012-06-17.log
2486
2487Wipe -f /var/log/boot.log
2488
2489Wipe -f /var/log/netconf.log
2490
2491Wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2492
2493Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / raidcall_7.2.8.log
2494
2495Wipe -f /root/.wine/drive_c/users/root/Application Data / raidcall / log / proto_7.2.8.log
2496
2497Wipe -f /pentest/voip/artemisa/logs/artemisa_2012-06-17.log
2498Clear
2499Wipe -f /pentest/cisco/cisco-torch/scan.log
2500
2501Wipe -f /pentest/wireless/freeradius-wpe/libltdl/config.log
2502
2503Wipe -f /pentest/wireless/freeradius-wpe/raddb/modules/detail.log
2504
2505Wipe -f /pentest/wireless/freeradius-wpe/config.log
2506Clear
2507Wipe -f /pentest/scanners/unicornscan/config.log
2508
2509Wipe -f /pentest/enumeration/irpas/libpcap-0.4/config.log
2510Clear
2511Wipe -f /pentest/enumeration/lanmap2/ref/cache-web/cache.log
2512
2513Wipe -f /pentest/exploits/rebind/src/termcap/config.log
2514Echo-e '\ e [32; 1m100% complete \ e [m'
2515Wipe -f /pentest/exploits/rebind/src/readline/config.log
2516Clear
2517
2518Echo -e '\ e [32; 1mTouch new archives \ e [m'
2519
2520Touch / var / log / lastlog
2521
2522Touch /var/log/netconf.log
2523
2524Touch /root/.bash_history
2525
2526Touch /var/log/boot.log
2527
2528Touch / var / log / messages
2529
2530Touch / var / log / secure
2531History -c
2532Wipe -f /root/.bash_history
2533Clear
2534Echo -e '\ e [32; 1mSearching * .log for / root / Desktop \ e [m'
2535Echo -e '\ e [32; 1mPlease Wait ... \ e [m'
2536CD /
2537Find -name * .log> /root/Desktop/log.txt
2538 Echo -e '\ e [32; 1mComplete. Press ENTER to return to the Menu. \ E [m'
2539Echo -e '\ e [32; 1mBy: Uid0 \ e [m'
2540Read
2541Clear
2542Cd / root /
2543Bash script.sh
2544Fi
2545
2546If [$ Menu -eq 5]; Then
2547Clear
2548Echo
2549 .
2550 _ / _--- ()
2551 Eur-lex.europa.eu eur-lex.europa.eu
2552 ==== - Bye Bye Babys --- === ;;;
2553 \ / V 2.0
2554 Eur-lex.europa.eu eur-lex.europa.eu
2555 (I.e.
2556 Eur-lex.europa.eu eur-lex.europa.eu
2557 I;
2558 Eur-lex.europa.eu eur-lex.europa.eu
2559 KBUM ..... ((((^ -))))
2560 -------------------------------------------------- ----------------
2561 Coded by Uid0 - 2013
2562 Version 2.0
2563'
2564Exit
2565Fi
2566
2567
2568
2569************************************************** **********************************************
2570
2571
2572
2573==========
25741.5 Shred
2575==========
2576
2577
2578The shred is even similar to the wipe so that as the wipe only does the process about 34 times in both internal and external files the shred does the process as many times as you want! Wonderful, is not it? Actually not very good because if a NOOB lammer fdp solve do so:
2579
2580 - Oh my god invadi bakery site I will format my pc and destroy the data of my hd I will put to do the process 50 times no one to catch.
2581
2582 Well it's expensive, will you deface all HD data about 50 times correct? In 15 time you do this your HD will already be on fire this is due to the fact that the cylinder is made of a very sensitive material and easy combustion and for there to be disfiguration of the data in all the HD it needs to rotate completely All its cylinders at high speed and it will only warm up and heat up to catch fire.
2583 I'll stop scrolling and then the commands will:
2584
2585
2586 Options:
2587
2588 -n = number of recordings
2589
2590 -z = zero all zeroed and no back
2591
2592 Other options in English:
2593
2594
2595 -f, --force change permissions to allow writing if necessary
2596 -n, --iterations = N overwrite N times instead of the default (3)
2597 --random-source = FILE get random bytes from FILE
2598 -s, --size = N shred this many bytes (suffixes like K, M, G accepted)
2599 -u, --remove truncate and remove file after overwriting
2600 -v, --verbose show progress
2601 -x, --exact do not round file sizes up to the next full block;
2602 This is the default for non-regular files
2603 -z, --zero add a final overwrite with zeros to hide shredding
2604 --help display this help and exit
2605 --version output version information and exit
2606
2607
2608
2609-> Command to destroy the partition
2610
2611# Shred -n 4 -z / dev / sda
2612
2613* Be aware, if your HD is IDE PRIMARY MASTER / dev / sda will be / dev / hda
2614
2615
2616
2617========================
26181.6 Cloning of cookies
2619========================
2620
2621 Good people, let's go on another topic, now I'll say about cloning cookies. Do you know what cookies are?
2622 They are small files that a website stores in your browser as prove that you who accessed a certain page or that you are the real owner of the account. Do not you understand?
2623
2624 Example:
2625
2626 -> You access your email account in google and put in keep me logged in, for gmail to certify that your identity is true it sends a cookie
2627
2628 First you must invade a wireless network so you can sniff what is happening, I advise public places or next to companies that in the sniffer you can pegr many wireless with weak encryption and break it down quickly. After invading the wireless I recommend using the wireshark sniffer that is In GUI interface or is very friendly despite being quite complete as well. Cloning a cookie is similar to cloning a MAC.
2629
2630 There are two methods of doing the cloning I will present the two most of the wireshark is easier, faster and precise.
2631
2632 First method: "Cloning" can be done with cookie management add-ons such as "Advanced Cookie Manager" in it you can add this addon in your browser to capture the cookies that run on sockets (http) of the network.
2633
2634 Second method: Turn on wireshark on the wireless network that was hacked and soon after you will see several packages being requested and sent to several servers, these several servers store cookies to get the cookie from gmail, yahoo, facebook, twitter and others Enable the wireshark filter to filter only HTTP packet because it is by this means (port 80 or 443) that cookies are sent, will appear several packets look in their description related to "cookie" as soon as you get the link just insert it In your url you will soon clone the cookie and assume the identity of the victim who received the cookie for certification of authenticity.
2635
2636
2637
2638====================================================================== ====
26391.7 Identifying Encryption Manually - HARDCORE
2640====================================================================== ====
2641
2642Let's start by listing the simplest and the least:
2643
2644
2645 Popular Hashes:
2646
2647
2648 MD5
2649 MD4
2650 MD2
2651 Sha1
2652 Sha256
2653 Sha384
2654 Sha512
2655 LM
2656 NT
2657 Base_64
2658 Rot_13
2659
2660
2661 Less known Hashes:
2662
2663Crc32
2664Crc32b
2665Snefru
2666Like
2667Adler32
2668Ripemd128
2669Ripemd160
2670Tiger128, 3
2671Tiger128, 4
2672Tiger160, 3
2673Haval128, 3
2674Haval128, 4
2675Haval 256.3
2676Whirlpool
2677Among others ...
2678
2679
2680 -> Manual recognition methods
2681
2682
2683 ## MD5:
2684
2685 They are always in 32 characters in length of 128 bits.
2686
2687 They are always in hexadecimal, use only characters 0-9 and AF
2688
2689
2690 ## SHA1:
2691
2692 They are always in 40 characters in length of 160 bits.
2693
2694 They are always in hexadecimal, use only characters 0-9 and AF
2695
2696 ## MySQL 4.1
2697
2698 They are always 16 characters long in 64-bit length
2699
2700 They are always in hexadecimal, use only characters 0-9 and AF
2701
2702 ## MySQL 5.0
2703
2704 They are always in 41 characters and always start with asterisks *
2705 They are always in hexadecimal, use only characters 0-9 and AF
2706
2707 ## MD5 (Wordpress)
2708
2709 They are always in 32 characters and always start with $ P $
2710
2711 They are always in hexadecimal, use only characters 0-9 and AZ and az
2712
2713 ## MD5 (phpbb3) - Used in forums.
2714
2715 They are always in 32 characters always starts with $ H $
2716
2717 They are always in hexadecimal, use only characters 0-9 and AZ and az