· 9 years ago · Feb 16, 2017, 09:54 AM
1-> Contents
2===============
3
41.1 - Introduction
51.2 - Identifying firewall
61.3 - Identifying doors
71.4 - Some TCP / UDP ports and their services
81.5 - Network Monitoring
91.6 - Updating your OS
101.7 - p0f (sniffer)
111.8 - Iptraf (Sniffer)
121.9 - Wireshark
132.0 - Router and PC
142.1 - Almost finishing the theory (hehe '
152.2 - Sniffando network
16
17-> Part 2
18==============
19
201.0 - P. I SAFETY
211.1 - FIREWALL
221.2 - wBuilder
231.3 - IPTABLES - Firewall
241.4 - Firewall Cyber ​​Hats version 1.1
251.5 - Intrusion Detection System (IDS)
261.6 - Snort For server (WEB)
271.7 - Getting hidden on the Internet
281.8 - How to clone a mac
291.9 - How to mask a ip
302.0 - Tunneling ips
312.1 - Sending Emails Anonymously
322.2 - HTTPS Protocol
332.3 - Honeypots - The irresistible Pot
342.4 - Honeynet
352.5 - Router Security
362.6 - Network Monitoring - Part. II
372.7 Network Monitoring - Graphical Interface
38
39-> Part 3
40=============
41
421.1 - Encrypting sensitive data - Truecrypt
431.2 - To the wise guys, If you connect the PF beat al ... FUDEU! - Destroying data.
441.3 - WIPE
451.4 - Script to clean All Logs
461.5 - Shred
471.6 - cookies Cloning
481.7 - Identifying encryption manually - HARDCORE
491.8 - End of Ezine
50
51
52
53 Well guys we start our ezine safety of your computer.
54So as you all already know no system is completely secure,
55but there are those systems that are what we call in the middle hacker "armored machines."
56These machines have software that are developed especially for such functions as:
57
58 1.0 * port filtering
59 * Packet filtering
60 * Real Network Monitoring
61 * Monitoring attempts to enter or exit suspicious packets (ICMP)
62 * Among other various tools that have to information security, most of them comes in Open Source (Open source) which greatly facilitates
63the life of programmers and power users to improve such sotwares or scripts.
64 But let's get down to business, start with a cursory review of protocols
65network and one of the most important to the footprint and fingerprint the application package and ICMP response.
66In a little while you will discover why.
67
68
69 1.1 * ICMP packets
70
71I will take a good explanation predicts, ICMP packets serve so that there is communication between two computers
72The scheme is the following:
73
74
751) PC 1 -------- ICMP -> Network ---> -> -> PC 2
76
772) PC 1 <------ icmp-- network <--- <- <- PC 2
78
79 PC1 IP: 155.125.55
80 IP PC2: 200.84.98
81
82 In the first scheme is the following PC 1 sends an ICMP "clean" but to and pre size for
83this inoculated in the layers of the package in the form of IP (address) and BYTES (size) ie the PC 1 sent
84a simple echo request to verify that the Host (PC 2) was active.
85 With the success of the PC communication two re-sends the ICMP packet to the PC1 with the same data that are upside down
86ie PC2 will send another ICMP packet to the PC1 with standard size 64 byts (standard size), with this you can see that the
87host (PC2) was active since responded to the "call" of PC1.
88 Well, on the day of ordinary users is well but as always has its exceptions exist people LAMMERS / Noobies calls that make use of this
89package as a means to scan more prescisamente computers check for firewall, open ports, operating system and / or rede.Mas topology you should be asking
90- As for example the identification of the so (operating system)? Very simple! The tool possessed a database of
91what is the time in which each operating system takes to re-transmit the ICMP packet assuming:
92
93Red hat - 1500 ms
94Backtrack - 2000 ms
95Arch Linux - 500 ms
96
97 Thereby the tool makes a comparison of the time it took to receive the response and compares it with the database when making a ratio.
98
99
100
101
102==============================
103 1.2 Identifying firewall
104==============================
105
106 A good method to identify firewall is by ICMP packets, like most admins know the main function of ICMP packets they create rules
107firewall for the machine to refuse such packages, we will draw you a picture:
108
109PC 1 ----> ---> ICMP (64 bytes) -> -> {} FIREWALL PC 2
110
111PC1 xxxxxxx.xxxxxxxxxxxxx.xxxxxxxxxx PC 2
112
113 Through this scheme can be noted that when the package arrived in the firewall was the diversion or rejeitamento of such packages by machine
114doing so nothing back to the attacker, then have nothing in response, nothing will return there two hypotheses or the machine possesses firewall
115that is refusing the package or this machine does not exist.
116
117
118
119===========================
1201.3 Identifying doors
121===========================
122
123 Also we use the ICMP packet to identify open ports and services run on the machine, the process to find the doors open
124in certain machines is the following:
125
126The attacker sends ICMP packets to the target's (obvious hehe) but instead of going to a default that is being filtered by the firewall or any other means of
127Prevention can be directed such packages to any ports an example:
128
129PC 1 ----> ICMP ---> -> -> PC 2 (p 23)
130PC 1 <---- ICMP <--- <- <- PC 2 (p 23 ON !!)
131
132Through this scheme was concluded that the attacker who was the PC 1 sent ICMP packets for a given PC 2 door an example used to 23 (Telnet)
133PC 1 then tries to "connect" to this port, if it is online the ICMP packet will go back because it was filtered by firewall.Mas if the ICMP
134back in some cases means that the door is open or is the target host (PC 2) responded to our "called" echo request.
135
136=============================================
1371.4 * Some TCP / UDP ports and their services
138=============================================
139
14021 FTP - file transfer
14122 ssh - remote machines
14223 telnet - remote machines
14325 SMTP - email protocol
14480 browser - Internet navigation
145113 pop3 - email protocol
146443 https - secure communication layer protocol
147==================================
148* 139 rpc - rpc windows protocol *
149==================================
150
151 - This last door I have highlighted is the oldest door and you will only see it and totally unprotected systems and windows (= 3)
152good, so if you find any with the 139 door open not miss the opportunity to break it because surely the computer possessed a safety very ruim.Porque tell it?
153by the fact that with an exploit of msfconsole you can exploitar this vuln (dcom).
154
155
156
157===========================
1581.5 Network Monitoring
159===========================
160
161 This theme is very important both for the part of attack and defense, is in the market currently several tools and scripts that
162do the actual monitoring of bitching rolling in your network (hehe), the tools and snnifers are nothing more than tools that intercept traffic
163passively ie will not interfere in the "paths", destinations and data pacotes.Bom, the theory has already been given so let's practice!
164 I'll start by citing various tools, their functions and results of both the attacker's point of view and from the point of view of the defender.
165
166
167===========================
1681.6 Updating your OS
169===========================
170
171Well before you start "for hands-on" before we upgrade our operating system.
172
173root @ CyberHats: ~ # apt-get update
174
175After the end run another command
176
177root @ CyberHats: ~ # apt-get upgrade
178
179
180
181===================
1821.7 p0f (sniffer)
183===================
184
185root @ CyberHats: ~ # p0f -i wlan0
186p0f - passive fingerprinting the utility, version 2.0.8
187(C) M. Zalewski <lcamtuf@dione.cc>, W. Stearns <wstearns@pobox.com>
188
189p0f: listening (SYN) on 'wlan0', 262 sigs (14 generic, cksum 0F1F5CA2) rule: 'all'.
190585 666 666: 47572 - UNKNOWN [S10: 64: 1: 60: M1460, S, T, N, W7:::.?] (Up 24 hrs)
191 -> 66.252.2.46:80 (link: Ethernet / modem)
192585 666 666: 47573 - UNKNOWN [S10: 64: 1: 60: M1460, S, T, N, W7:::.?] (Up 24 hrs)
193 -> 66.252.2.46:80 (link: Ethernet / modem)
194585 666 666: 46500 - UNKNOWN [S10: 64: 1: 60: M1460, S, T, N, W7:::.?] (Up 24 hrs)
195 -> 69.31.76.42:80 (link: Ethernet / modem)
196585 666 666: 55097 - UNKNOWN [S10: 64: 1: 60: M1460, S, T, N, W7:::.?] (Up 24 hrs)
197 -> 173.252.100.27:80 (link: Ethernet / modem)
198
199Well, let's piece by piece.
200
2011st) Right at startup script can be seen that it runs in passive mode ie, the sniffer
202does not interfere with traffic on your network.
203
2042nd) It detects real-time transmission of packets that are coming out of your computer to the external environment (internet)
205as you can see in this example:
206
207+++++++++++++++++++++++ |
208585 666 666: 47572 - |
209 -> 66.252.2.46:80 |
210+++++++++++++++++++++++ |
211
212 My ip 585 666 666 (my PC) was communicating through the port 47572 with your computer or ip 66.252.2.46 server on port 80,
213as you already know that port 80 is browser may know that this is the ip of the site I'm visiting at this time for my browser.
214
215
216
217=====================
2181.8 Iptraf (Sniffer)
219=====================
220Good 1st step is to install iptraf, in the case of ubuntu (backtrack and others are of pentest).
221
222root @ CyberHats: ~ # apt-get install Iptraf
223
224after that it will automatically install to run it just follow the following command:
225
226root @ CyberHats: ~ # iptraf -i "wlan0" (in quotation marks ["] is to modify by your network, eth0 or wlan0)
227
228After this he will begin shooting in passive mode (as we saw the definition) does not interfere with operation of the network.
229
230================
2311.9 Wireshark
232================
233Well folks, wireshark sniffer is a very well known by users who do pentest because of having an interface
234very interactive with their use and be easy to understand, logical that the user must have some basis on protocols
235networks because this software possesses many tools and the most advanced parts require more knowledge about networks structures, go to
236a brief explanation of it:
237
2381 We will install it
239
240root @ CyberHats: ~ # apt-get install wireshark
241
242If this method has no effect or experience any error can download the official website.
243
244After downloading it already creates a shortcut on your menu bar, good let's messing it.
245
246A brief explanation of networks:
247
248Well as everyone knows that there is communication between computers are communication platforms (Ava !!)
249These links are provided through packages that contain functions and ports specify in which the interaction occurs between
250Port and protocol, for example:
251
252PC1 (DOOR: 22 PROTOCOL: SSH) -----> Communication ---> Sending packages -> -> PC2 (DOOR: 22 PROTOCOL: SSH)
253PC1 (DOOR: 80 PROTOCOL: SOCKET) -----> Communication ---> Sending packages -> -> PC2 (DOOR: 80 PROTOCOL: SOCKET)
254
255As can be seen occurs disclosure of various package with several simultanêamentes computers, but no packets interfere
256on the other, the "lines" of communication occur in parallel with the base of each protocol interacts seamlessly with your input means
257 and output (ports).
258
259=================
2602.0 Router and PC
261=================
262
263Routers are devices that act intelligently and / or stupid way (WHAT is often the case), it is the bridge to the external environment that is the internet
264so that you, the user has access to the internet which is the external environment you prescisa be connected to one of these devices, or not (but we will not go into details).
265That is, the PC will have a ip connection and the other router, will illustrate this:
266
267PC1 (192.168.0.0) --------------------> ROUTER (192.555.0.0) ----------> ****** *****************> INTERNET
268 /
269 /
270 /
271 /
272 /
273 /
274 /
275 **
276 PC2 (168,111,111)
277
278
279What did I tried to demonstrate to you is that your router or any appliances that serve as a bridge for the connection to the internet
280have MAC addresses and different IP, for that is the multiple connection of several pc's, but after several
281connections is very difficult router handle the demand packages, bytes and doors to open with this can happen crash the network.
282
283
284====================================
2852.1 Almost ending the theory (hehe '
286====================================
287
288Just kidding, already finished the theoretical part we will now for the software.
289
290
291======================
2922.2 Sniffando network
293======================
294
295Well, the first step is to now go start in the upper left corner and select the network you want to capture packets.
296In my case is eth0 then will click on it and put START!
297
298The moment you start the packet capture wireshark comes into passive mode and intala as "gatherer" packages in the passage
299the internal environment to the external that for some people is the router.
300
301Let us illustrate this method:
302
303PC1 (192.168.0.0) --------------------> ROUTER (192.555.0.0) - | --- | ---------- > ***********************> INTERNET
304 / -----
305 / |
306 / |
307 / |
308 /
309 / WIRESAHRK
310 /
311 **
312 PC2 (168,111,111)
313
314
315* Software as can be seen not influence anything in the flow of network it just makes a kind of reading the packet information.
316 * Personal Well, I'm sorry but I can not teach wireshark altogether but to give you a basis of both networks as this great software for your explanation
317Full is somewhat complex qaunto for it can use dorks to find the tutorials.
318
319
320Part more sinister hehe "
321
322====================
3231.0 SAFETY P. I
324====================
325
326==============
3271.1 FIREWALL
328==============
329
330Well of course everyone who is reading this ezine should know what a firewall so let's skip the boring part of having to explain what a firewall firewalls work in many ways the most used are firewalls in packages levels or levels of applications it is impossible to talk about firewalls on Linux without mentioning iptables.
331
332=============
3331.2 wBuilder
334=============
335
336
337Every network worth its salt, you need a firewall! And it is an excellent tool that will help you create the security settings.
338
339For users of the 2.4 kernel that are already accustomed to using iptables, this tool complements the work, making the creation of rules a simple task and with an advantage by creating different groups that may use the similar rules, you can use the mouse to click and drag, carrying these settings to other groups, all in a very friendly environment.
340
341
342To install, use the command:
343
344# Apt-get install fwbuilder-iptables
345
346For more information, please visit:
347http://www.fwbuilder.org/
348
349
350
351
352========================
3531.3 IPTABLES - Firewall
354========================
355
356 Well folks, we go to a famous strainer best known packages as iptables.Estes software developed under the GNU was created with the aim of analyzing the header (header) of packets traveling in your network then occur after this analysis iptables decide what actions take based on rules and predestined tables that the user already had scheduled the command line interface (Shell) by the user.
357
358 An example of iptables script to apply the following settings which are notional just write them in the shell of your system (recommend linux) .There you worry if you do not understand WHAT is saying, after all has not yet been submitted either option, only follows the script to give you an notion that a firewall iptables are lines of commands similar to these:
359
360 ################################################## ################
361 #OBS: CAUTION! As in almost all programming languages ​​the #
362 #caractere # is comment and therefore the interpreter not #
363 #considera as part of the code. #
364 ################################################## ################
365
366 iptables -N block
367 iptables -A block -m state --state ESTABLISHED, RELATED -j ACCEPT
368 iptables -A block -m state --state NEW -i! ppp0 -j ACCEPT
369 iptables -A block -j DROP
370
371 ## Jumping out of the INPUT and FORWARD chains for the CHAIN ​​block.
372 iptables -A INPUT -j block
373 iptables -A FORWARD -j block
374
375
376
377
378 Good as it was to be expected there are many questions, what it is CHAIN ​​out, what means -A -m, --state, among other syntaxes.
379 Iptables is divided into tables, KERNEL linux (which is the intermediary point between the software and the hardware, the operating system CORE) already comes as default table "filter" having 3 CHAIS (lists of rules):
380
381 # INPUT -> Package Check
382
383 # OUTPUT -> Package output
384
385 # FORWARD -> packages direction
386
387 Example of application of 3 CHAIS cited above (without sintaxez):
388
389 - Do you want to block any ICMP packet input to let your host a little more invisible, then we use a cancellation of that package by CHAIN ​​"INPUT" which is the CHAIN ​​responsible for incoming packets.
390
391 - If you have not blocked ICMP packet input and a host sends an ECHO REQUEST, so "biological" is computer will respond with an ECHO REPLY ie will enter an ECHO REQUEST by CHAIN ​​INPUT and will leave an ECHO REPLY by CHAIN OUTPUT.Caso you do not want your computer does not return an ECHO REPLY to warn that this live simply cancel the outgoing ICMP packets which is responsible for ECHO and ECHO REPLY REQUEST.
392
393 - Are you with some telnet version outdated but your firewall is blocking the port scanning the attacker, and that he is playing the cegas.O Forward discovers after several scanning techniques that you possessed a telnet service outdated but he does not discover door and as telnet by dedault runs on port 23 it will only run the exploit on port 23 as suposição.Mas if you do not possessed so much time to be looking for methods to update and stop the attacker exploitamento in your system just give in FORWARD port 23 to another port as the 443 which is the https service (fictitious method) trafeco the door 23 will pass through port 443 blocking the exploit the attacker because the https is different from telnet.
394
395
396 To understand-we'll make a better first graph to illustrate how the flow of packets on a computer without firewall that is only with the INPUT and OUTPUT rules.
397
398
399
400 INPUT
401 packages
402 ----------------
403 \ / EXIT
404 | ------------> I.NET
405 | |
406 | |
407 ___ \ / ____ ______________ ___ | ____
408 / \ | | / \
409 | INPUT | -----------------> | COMPUTER | --------------------> | OUTPUT |
410 \ _________ / | ____________ | \ _______ /
411
412
413
414 # In this scheme the packets follow the normal flow, ie the fragmentas package with header (incorrect header will be accepted) WHAT can be a fuzzing technique that is sending fragmented packets to a machine and that this machine was to reject it. Just as excess packets will be accepted caused by a DoS or DDoS.
415
416
417
418In this next diagram we will talk about a data stream on a computer that possesses a firewall with forwad enabled:
419
420
421
422 INPUT ________
423 packages / \ OUT
424 ----------------> ----------------------> | FORWARD | ------- --------------------------------------->
425 \ / \ ________ / EXIT
426 | ------------> I.NET
427 | |
428 | |
429 ___ \ / ____ ______________ ___ | ___
430 / \ | | / \
431 | INPUT | -----------------> | COMPUTER | -------------------------> | OUTPUT |
432 \ _________ / | ____________ | \ _______ /
433
434
435
436
437
438 # In this scheme the package follow the flow but in the mains input forwad reads the header of packets to see if any fit the list of rules determined by the user, if fit as the example of ICMP instead of him to move on INPUT -> pass through the machine and go to -> OUTPUT he will fall in deireto FORWARD and will be discarded.
439
440
441 Remember that there is not only the filter table, but as the KERNEL adopts it as default (default) people get used to using it and forget the other two, they are:
442
443
444 -> Filter: this table is the default if not declared in any rule, that is, it allows filtering rules INPUT (for packets destined for this box) OUTPUT (for locally generated packets) and FORWARD (any package that crosses the firewall, come from a machine and directed the other).
445
446 -> Nat: when there is used or when a NAT packet responsible for creating a new connection is found, that is, when "dport" (destination port) is different from known IP. Example: Data passage of a private network to the Internet. Allows the PREROUTING chains (to change incoming packets before routing), OUTPUT (for locally generated packets change before routing), and POSTROUTING (to change the source address of connections to something different).
447
448 -> Mangle: serves to specify special actions for the treatment of traffic through the chains. In this table there are two chains: PREROUTING and OUTPUT. Options with the Type of Service (TOS) are specified in this table to sort and considerably increase the speed of traffic considered in real time.
449
450
451
452 -> As I said in the TABLES has CHAINS, follows the difference enters them:
453 IMPORTANT:
454
455 ## First, the names of built-in chains will be written in UPPERCASE rather sensitive, because the INPUT and OUTPUT chains only receive packets destined locally and locally generated. Before, these chains aim to all incoming and outgoing packets, respectively.
456
457 ## The `-i 'flag now means the incoming interface, and only works in the INPUT and FORWARD chains. Rules in the FORWARD or OUTPUT chains that used `-i 'should be changed to` -o'.
458
459 ## TCP and UDP ports now need to be spelled out with the --source-port or - sport (or --destination-port / - dport), and must be placed after the `-p tcp 'or` -p udp ', as this loads the TCP or UDP extensions respectively.
460
461 ## The TCP -y flag is now syn, and must be positioned after `-p tcp '.
462
463 ## Finally the DENY target is now DROP.
464
465 ## Zeroing single chains while listing them works.
466
467 ## Zeroing built-in chains also clears the counters of its policies.
468
469 ## List the chains gives you the counters.
470
471 ## REJECT and LOG are now extended targets, meaning they are separate kernel modules.
472
473 ## Names of chains can be up to 31 characters.
474
475 ## MASQ is now MASQUERADE and uses a different syntax. REDIRECT, while keeping the same name, has also undergone a syntax change. See the NAT-HOWTO for more information on how to configure both.
476
477 ## The -o option is no longer used to direct packets to the userspace device (see -i above). Packets are now sent to userspace via the QUEUE target.
478
479
480 -> I will spend the syntaxes that are iptables for managing tables and rules:
481
482
483
484 -P Sets a default rule
485
486 -A Adds a new existing rule.
487 This takes precedence over the -P
488
489 D goes out a rule
490
491 -L Lists the existing rules
492
493 -F Delete all rules
494
495 -I Inserts a new rule
496
497 -h Very useful because it shows the help
498
499 -R Replace a rule
500
501 -C Do a check of the existing rules
502
503 -Z Clears a specific rule
504
505 N Creates a new rule with a name
506
507 -X Deletes a specific rule by name
508
509
510
511 NOTE: Recomento whenever you create firewall rules zero it before turning off the computer with the syntax mentioned above as:
512 # Iptables -F
513 Shortly after this I created a boot file with the firewall lines in bash (just follow the Superman firewall installation).
514
515
516
517
518-> Data structure for packet filtering irrigation management (taken from http://www.tccamargo.com/linux/tutoriais/iptables.html)
519
520-s: Specifies the package source. This can be either a network or host. Possible combinations may be:
521
522-s 192.168.0.0/255.255.255.0
523
524or
525
526-s 192.168.0.0/24
527
528NOTE: In the second case we are specifying the network mask as the number of 1 bits, for example:
529
530Netmask 255.0.0.0 = 8
531Network mask 255.255.0.0 = 16
532Netmask 255.255.255.0 = 24
533
534
535In the above example we are specifying an entire C mask network, in the example below we specify a host:
536
537-s 192.168.30.51/255.255.255.255
538
539or
540
541-s 192.168.30.51
542
543can also look like this:
544
545-s 192.168.30.51/32
546
547NOTE: The mask bit numbers 1 to host is 32.
548
549
550We can specify so:
551
552-s www tccamargo.com
553
554
555We can specify any source also:
556
557-s 0.0.0.0/0.0.0.0
558
559or
560
561-s 0/0
562
563
564-d: Specifies the destination of the packet. The syntax is the same as -s
565
566
567-p: Protocol used in the rule. Can be tcp, udp, icmp:
568
569-p tcp
570-p udp
571-p icmp
572
573
574-i: input interface, ie, network card, modem or connection interface that you will get the package to be treated.
575
576-i eth0
577-i eth1
578-i ppp0
579
580
581-o: output interface. The syntax is the same as -i, in which case will be sending the package to be treated.
582
583
584! : Excludes certain argument:
585
586-i! eth0 - Refers to any incoming interface other than eth0
587-s! 192.168.0.45 - Refers to any input except the address 192.168.0.45
588
589
590--sport: Refers to the source port. This should be accompanied functions -p tcp and -p udp:
591
592-p tcp -Sport 80 - Refers to the source port 80 under protocol tcp
593
594
595dport: Refers to the destination port. Just as -Sport function, it works only with the -p tcp and -p udp. The syntax is similar to -Sport
596
597
598Through -Sport and -dport functions can specify not only a specific port as well as a port range:
599
600--sport 33435: 33525
601
602#######################################################################################################
603
604 Actions:
605
606Actions always comes after the -je parameter usually are:
607
608
609 ACCEPT - Accepts and allows the passage of the package.
610 DROP - Does not allow the passage of the package and leaves it not giving receiving signals.
611 REJECT - Just as the DROP, does not allow the passage of the package, but issues a warning (icmp unreachable)
612 LOG - Creates a log related to rule in / var / log / messages
613
614
615-> Structure of a iptables string:
616
617With these factors can create our rules with the following composition:
618
619
620 # Iptables -A FORWARD -s 192.168.0.45 -p icmp -j DROP
621 Where: A (option) / FORWARD (Chain) / -s 192.168.0.45 -p icmp (Data) -j DROP (Action)
622
623########################################################################################################
624
625 -> Methods to save the iptables rules:
626 There are two methods to save the rules created by iptables:
627
628
6291 - Saving the rules
630
631
632 After the fast rules can save them with this command:
633
634 # Iptables-save> <give a name to the file>
635
636
637 To retrieve them use this command:
638
639 # Iptables-restore> <file name>
640
641
642
643
6442- Create a bash script on to the rules are implemented, it is very easy to do this just go in a text editor and paste your sucessivamentes rules and saved in .sh; name example: FIREWALL.sh
645
646 Implementation of the firewall: NO linux or double-click over the icon, if it works do not go in the terminal enter the directory where this script and type:
647 #bash nome-do-script.sh
648
649 Below is a sample script in bash iptables:
650
651
652
653
654 #! / Bin / bash
655
656#limpando tables
657iptables -F &&
658iptables -X &&
659iptables -t nat -F &&
660iptables -t nat -X &&
661
662#liberando internal access network
663iptables -A INPUT -p tcp -s --syn 192.168.1.0/255.255.255.0 -j ACCEPT &&
664iptables -A OUTPUT -p tcp -s --syn 192.168.1.0/255.255.255.0 -j ACCEPT &&
665iptables -A FORWARD -p tcp -s --syn 192.168.1.0/255.255.255.0 -j ACCEPT &&
666
667#compartilhando the web on the internal network
668iptables -t nat -A POSTROUTING -s -o eth1 -j MASQUERADE 192.168.1.0/255.255.255.0 &&
669echo 1> / proc / sys / net / ipv4 / ip_forward &&
670
671# Protective against port scanners hidden
672iptables -A INPUT -p tcp --tcp-SYN, ACK, FIN, RST RST -m limit --limit 1 / s -j ACCEPT
673
674# Blocking tracertroute
675iptables -A INPUT -p udp -s 0/0 -i eth1 --dport 33435: 33525 -j DROP
676
677#Protecoes Against attacks
678iptables -A INPUT -m state --state INVALID -j DROP
679
680#termina
681echo "Iptables Ready"
682
683
684 ################################################## #############################################
685
686-> I recommend also save the script to put it to start automatically on your computer, you can do this with the following steps:
687
688 1 Go to the terminal and enter the directory (/etc/init.d) where is the script.
689
690 2- Save the /etc/init.d/"secure.sh directory "->" secure.sh "is the script name.
691
692 3- root @ cyberhats: # chmod 755 /etc/init.d/secure
693
694
695===================================
6961.4 Firewall Cyber ​​Hats version 1.1
697===================================
698
699Well guys I did a simple firewall and I have to source it for you guys here it is barring all, if you are a user who wants to be protected with ctz you will get hehe now if you are a pentester making several invasions need to make some changes simple to allow their tools to run smoothly type you will need to put rules to accept metasploit door and just nothing hard to do.
700
701I'll make a simple Staff here how to put it in the boot of your linux so every time u turn on the pc it will activate alone;)
702
7031 - Copy the source of it just below this Staff and save a text file named "firewall" in dir "/etc/init.d".
704
7052 - Once that is done in a terminal type:
706
707root @ cyberhats: # chmod 755 /etc/init.d/firewall
708
7093 - Then type in the terminal "update-rc.d firewall defaults":
710
711root @ cyberhats: # update-rc.d firewall defaults
712Adding system startup is /etc/init.d/firewall ...
713/etc/rc0.d/K20firewall -> ../init.d/firewall
714/etc/rc1.d/K20firewall -> ../init.d/firewall
715/etc/rc6.d/K20firewall -> ../init.d/firewall
716/etc/rc2.d/S20firewall -> ../init.d/firewall
717/etc/rc3.d/S20firewall -> ../init.d/firewall
718/etc/rc4.d/S20firewall -> ../init.d/firewall
719/etc/rc5.d/S20firewall -> ../init.d/firewall
720
7214 - And just now Start scan the firewall with the command "/etc/init.d/firewall start":
722
723root @ cyberhats: # /etc/init.d/firewall start
724- Cleaning rules: [OK]
725- Climbing ICMP ECHO-REQUEST protection MESSAGES sent to BROADCAST or MULTICAST: [OK]
726- Climbing protection against ICMP redirect request: [OK]
727- Climbing protection of Envido MESSAGES redirected ICMP: [OK]
728- PING: [OK]
729- Packet Forwarding: [OK]
730- SSH: [OK]
731- Stabilizing connections: [OK]
732- Block all connections: [OK]
733- Climbing protection ip spoofing: [OK]
734- Disabling IPv4 transmission: [OK]
735- Protection against SYN-Flood: [OK]
736- Loopback: [OK]
737- Scans Protection - [OK]
738- Protection against SYN invalid packages: [OK]
739- Protection against incoming packets that can cause data loss: [OK]
740- Protection against malformed packets XMAS: [OK]
741- DNS: [OK]
742- NTP: [OK]
743- WHOIS: [OK]
744- FTP: [OK]
745- HTTP / HTTPS: [OK]
746- SMTP: [OK]
747- POP: [OK]
748- IMAP: [OK]
749- Reverse: [OK]
750- MSF: [OK]
751- From Firewall Management: [OK]
752- Firewall [OK]
753
754
755Below is the source code of the firewall:
756
757-------------------------------------------------- ----------------------
758
759#! / Bin / sh
760# Fatal Error & Cyber ​​Hats
761# By Sup3rm4n
762#
763# .88888888 :.
764# 88888888.88888.
765# .8888888888888888.
766# 888888888888888888
767# 88 '_`88'_ `88888
768# 88 88 88 88 88888
769# 88_88 _ :: _ 88_: 88888
770# 88 :::, ::, 8888 :::::
771# 88` ::::::::: '' 8888
772# .88 '::::' 8:88.
773# 8888 `8: 888.
774# .8888 '' 888888.
775# .8888: .. ::.. ...: '8888888 :. <--- EI PINGUIN KITTEN, OTHERWISE TO KNOW BEST OF YOU ...
776# .8888. ' '`'` :: 88: 88888 --- HAHA GATINHA SO SORRY, YOU WILL NOT PASS MY FIREWALL HEHE.
777# .8888 '' .888: 8888.
778# 888: 8. 888: 88888
779# .888: 88:. 888: 88888:
780# 8888888. :: 88: 888888
781# `. ::. 888. :: .88888888
782#. ::::::. 888. :: ::: `8888 '.:.
783# ::::::::::. 888 '. ::::::::::::
784# 8 :::::::::::: ':.. 8 ::::::::::::.
785#. ::::::::::::::. .: 888 :::::::::::::
786::::::::::::::: # 88: .__ ..: 88888 ::::::::::: '
787`# '. ::::::::::: 88888888888.88 :::::::::'
788# '' ::: _: '-' '-'-' '': _ :::: ''
789#
790################################################## #############
791#
792# -> LOGS AVAILABLE IN: / var / log / firewall
793#
794# -> CONTROLS TO MONITOR LOGS: tail -f / var / log / messages
795#
796# -> Save in /etc/init.d/firewall
797#
798################################################## #############
799
800case "$ 1" in
801start)
802
803# Cleaning rules
804iptables -t filter -F
805iptables -t filter -X
806echo - Cleaning rules: [OK]
807
808# ICMP ECHO-REQUEST Tips MESSAGES sent to BROADCAST or MULTICAST
809echo 1> / proc / sys / net / ipv4 / icmp_echo_ignore_broadcasts
810echo - Climbing ICMP ECHO-REQUEST protection MESSAGES sent to BROADCAST or MULTICAST: [OK]
811
812# Protection redirect icmp request
813echo 0> / proc / sys / net / ipv4 / conf / all / accept_redirects
814echo - Climbing protection against ICMP request forwarding: [OK]
815
816• Do not send ICMP redirect MESSAGES
817echo 0> / proc / sys / net / ipv4 / conf / all / send_redirects
818echo - Climbing protection of Envido MESSAGES redirected ICMP: [OK]
819
820# ICMP (Ping)
821iptables -t filter -A INPUT -p icmp -j ACCEPT
822iptables -t filter -A OUTPUT -p icmp -j ACCEPT
823echo - PING: [OK]
824
825# Package logs with missing Mangle (due to wrong routes) on your network
826echo 1> / proc / sys / net / ipv4 / conf / all / log_martians
827
828# Packages redirect Activation (required for NAT)
829echo "1"> / proc / sys / net / ipv4 / ip_forward
830echo - Packet Forwarding: [OK]
831
832# SSH accepted
833iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
834echo - SSH: [OK]
835
836• Do not break established connections
837iptables -A INPUT -m state --state RELATED, ESTABLISHED -j ACCEPT
838iptables -A OUTPUT -m state --state RELATED, ESTABLISHED -j ACCEPT
839echo - Stabilizing connections: [OK]
840
841# Block all connections by default
842iptables -t filter -P INPUT DROP
843iptables -t filter -P FORWARD DROP
844iptables -t filter -P OUTPUT DROP
845echo - Block all connections: [OK]
846
847# Ip spoofing protection
848echo "1"> / proc / sys / net / ipv4 / conf / default / rp_filter
849echo - Climbing protection ip spoofing: [OK]
850
851# Disable sending the IPV4
852echo 0> / proc / sys / net / ipv4 / ip_forward
853echo - Disabling IPv4 transmission: [OK]
854
855# SYN-Flood Protection
856iptables -N syn-flood
857iptables -A syn-flood -m limit --limit 10 / second --limit-burst 50 -j RETURN
858iptables -A syn-flood -j LOG --log-prefix "SYN FLOOD"
859iptables -A syn-flood -j DROP
860echo - Protection against SYN-Flood: [OK]
861
862# Loopback
863iptables -t filter -A INPUT -i it -j ACCEPT
864iptables -t filter -A OUTPUT -o it -j ACCEPT
865echo - Loopback: [OK]
866
867# Tips connections scans
868iptables -A INPUT -m recent --name scan --update --seconds 600 --rttl --hitcount 3 -j DROP
869iptables -A INPUT -m recent --name scan --update --seconds 600 --rttl --hitcount 3 -j LOG --log-level --log-prefix info "recent Scan"
870echo - scans Protection - [OK]
871
872# Tips SYN packets invalid
873iptables -A INPUT -p tcp --tcp-flags ALL ACK, RST, SYN, FIN -j DROP
874iptables -A INPUT -p tcp --tcp-SYN, FIN SYN, FIN -j DROP
875iptables -A INPUT -p tcp --tcp-SYN, RST SYN, RST -j DROP
876iptables -A INPUT -p tcp --tcp-flags ALL ACK, RST, SYN, FIN -j LOG --log-level info --log-prefix "Packages SYN Detected"
877iptables -A INPUT -p tcp --tcp-SYN, FIN SYN, FIN -j LOG --log-level info --log-prefix "Packages SYN Detected"
878iptables -A INPUT -p tcp --tcp-SYN, RST SYN, RST -j LOG --log-level info --log-prefix "Packages SYN Detected"
879# Tips SYN packets invalid
880iptables -A OUTPUT -p tcp --tcp-flags ALL ACK, RST, SYN, FIN -j DROP
881iptables -A OUTPUT -p tcp --tcp-SYN, FIN SYN, FIN -j DROP
882iptables -A OUTPUT -p tcp --tcp-SYN, RST SYN, RST -j DROP
883iptables -A INPUT -p tcp --tcp-flags ALL ACK, RST, SYN, FIN -j LOG --log-level info --log-prefix "Packages SYN Detected"
884iptables -A INPUT -p tcp --tcp-SYN, FIN SYN, FIN -j LOG --log-level info --log-prefix "Packages SYN Detected"
885iptables -A INPUT -p tcp --tcp-SYN, RST SYN, RST -j LOG --log-level info --log-prefix "Packages SYN Detected"
886echo - Protection against SYN invalid packages: [OK]
887
888# If certifies that new packages are SYN, otherwise they Tips
889iptables -A INPUT -p tcp! --syn -m state --state NEW -j DROP
890
891# Discard packets with incoming fragments. Attack that can cause data loss
892iptables -A INPUT -f -j DROP
893iptables -A INPUT -j LOG --log -f-level --log-prefix info "Pct of Fragmented Input"
894echo - Protection against incoming packets that can cause data loss: [OK]
895
896# Tips malformed packets XMAS
897iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
898iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LOG --log-level info --log-prefix "Packages malformed XMAS"
899echo - Protection against malformed packets XMAS: [OK]
900
901# DNS In / Out
902iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
903iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
904iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
905iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
906echo - DNS: [OK]
907
908# NTP Out
909iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT
910echo - NTP: [OK]
911
912# WHOIS Out
913iptables -t filter -A OUTPUT -p tcp --dport 43 -j ACCEPT
914echo - WHOIS: [OK]
915
916# FTP Out
917iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
918iptables -t filter -A OUTPUT -p tcp --dport 30000: 50000 -j ACCEPT
919# In FTP
920iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT
921iptables -t filter -A INPUT -p tcp --dport 30000: 50000 -j ACCEPT
922iptables -t filter -A INPUT -m state --state ESTABLISHED, RELATED -j ACCEPT
923echo - FTP: [OK]
924
925# HTTP + HTTPS Out
926iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
927iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
928# HTTP + HTTPS In
929iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
930iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
931echo - HTTP / HTTPS: [OK]
932
933# SMTP Mail: 25
934iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
935iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT
936echo - SMTP: [OK]
937
938# Mail POP3: 110
939iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT
940iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT
941echo - POP: [OK]
942
943# Mail IMAP: 143
944iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT
945iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT
946echo - IMAP: [OK]
947
948# Reverse
949iptables -t filter -A INPUT -p tcp --dport 77 -j ACCEPT
950iptables -t filter -A OUTPUT -p tcp --dport 77 -j ACCEPT
951echo - Reverse: [OK]
952
953# MSF
954iptables -t filter -A INPUT -p tcp --dport 7337 -j ACCEPT
955iptables -t filter -A OUTPUT -p tcp --dport 7337 -j ACCEPT
956echo - MSF: [OK]
957
958#######################################
959# Firewall WEB Management
960touch / var / log / firewall
961chmod + x / var / log / firewall
962/ Var / log / firewall -A INPUT -p icmp -m limit --limit 1 / s -j LOG --log-level info --log-prefix "ICMP Dropped"
963/ Var / log / firewall -A INPUT -p tcp -m limit --limit 1 / s -j LOG --log-level info --log-prefix "TCP Dropped"
964/ Var / log / firewall -A INPUT -p udp -m limit --limit 1 / s -j LOG --log-level info --log-prefix "UDP Dropped"
965/ Var / log / firewall -A INPUT -f -m limit --limit 1 / s -j LOG --log-level warning --log-prefix "FRAGMENT Dropped"
966/ Var / log / firewall -A INPUT -m limit --limit 1 / --limit-minute burst 3 -j LOG --log-level --log-prefix DEBUG "IPT INPUT packet died:"
967/ Var / log / firewall -A INPUT -m limit --limit 3 / minute --limit-burst 3 -j LOG --log-level --log-prefix DEBUG "IPT INPUT packet died:"
968echo - From Firewall Management: [OK]
969
970echo - Firewall [OK]
971exit 0
972;;
973
974stop)
975echo "Turning off Firewall ..."
976iptables -P INPUT ACCEPT
977iptables -P OUTPUT ACCEPT
978iptables -t filter -F
979echo "Firewall Off!"
980echo "Coded By Sup3rm4n"
981exit 0
982;;
983
984restart)
985/etc/init.d/firewall stop
986/etc/init.d/firewall start
987;;
988
989*)
990echo "Usage: /etc/init.d/firewall {start | stop | restart}"
991exit 1
992;;
993esac
994
995----------------------------------------------------------------------------------------------------------------
996
997======================================
9981.5 Intrusion Detection System (IDS)
999======================================
1000
1001So galerinha IDS also known as intrusion detection system intrusion attempts capture in real time, its operation is simple and effective, IDS examines all packets that are traveling on the network and searches for foreign subscriptions all signatures fleeing standard are classified as an attack, the IDS can act only alerting admins or applying actions in order to stop the attacks.
1002
1003There are two types of IDS those who are placed in the network where the host is to monitor known as NIDS and host-based systems known as HIDS they are placed on own host to be monitored.
1004
1005for more information: http://www.snort.com.br/comofuncionaids.asp
1006
1007=================================
10081.6 Snort For server (WEB)
1009=================================
1010
1011
1012An IDS (Intrusion Detection System) is a tool that analyzes network traffic and logs intrusion attempts. With it is possible to study the methods used by these "likely invaders" and based on these reports, create new security rules.
1013
1014For this type of service Snort is the most widely used tool on servers around the internet. Besides its use in Linux, is also available for Windows and can be downloaded in two versions on your website.
1015
1016Add this line to your sources.list:
1017
1018deb http://people.debian.org/~ssmeenk/snort-stable-i386/ ./
1019
1020To install, use the command:
1021
1022# Apt-get install snort
1023
1024The snort NIDS is the best I know, if anyone knows a better let me hehe, u can download it on their official website tb "http://www.snort.org/start/download" this is an open source tool made in C developed by Martin Roesch so you can make any changes you want in it according to what you need.
1025
1026How to use it:
1027
1028After download it vocêr will set the snort.conf file which is usually in /etc/snort/snort.conf, ook so here we go.
1029
1030root @ cyberhats: # vim /etc/snort/snort.conf
1031
1032In your terminal you will edit the following parts of the file:
1033
1034--------------------------
1035
1036# Like this:
1037
1038var HOME_NET XXX.XXX.XXX.XXX <--- in place of xxx.xxx.xxx.xxx put the ip host to be monitored
1039
1040# Set up the external network addresses as well. A good start may be "any"
1041var EXTERNAL_NET any <--- be sure to be any if quizer to get notified when any ip try some attack its host
1042#var EXTERNAL_NET! $ HOME_NET
1043
1044-------------------------
1045
1046Then run snort with the command:
1047
1048root @ cyberhats: # service snort start
1049
1050Then put it on alert with the command:
1051
1052root @ cyberhats: # snort -q -i wlan0 -c -A console /etc/snort/snort.conf <- wlan0 is my interface change according to your
1053
1054To verify that snort is really exutando:
1055
1056root @ cyberhats: # ps ax | grep snort
1057
1058Ready is alert and is already more protected your system hehe
1059
1060===============================
10611.7 Getting hidden on the Internet
1062===============================
1063
1064Almost everything we do is registered on the Internet and that much of the time
1065can be used against you, a common User hardly has privacy
1066on the internet because all he does is registered with a simple search on
1067google you can discover a person's information does not know if
1068protect and remain anonymous, also almost all websites visited
1069keep registros.Se you are like me and prizes for its privacy, but do not know
1070how to stay anonymous on the internet I advise reading is part of the ezine. This
1071part is more directed at Beginners or Noobs so if you're a guy
1072already digs of paranaues can skip is part.
1073
1074A great site for you to check the level of your anonymity is the Internet site
1075Troubleshooting and Forensics (IPduh) moreover it is an excellent site for
1076you do fingerprint and footprint (which will be addressed later on in
1077our ezine), the website url is: http://ipduh.com/anonymity-check/
1078
1079OOK then comes rolling and lets get down to it, the websites you
1080visit store logs, although Anatel not help specific form which will be
1081the data to be stored in the discussion PL 84/1999 debate and Marco Civil
1082states that only through the date, time, ip and the gmt are sufficient to discover
1083everything about you.
1084
1085Almost all people use google.com but unfortunately google captures information
1086its for this reason I advise you to use other search engines q are execelentes such as
1087https://startpage.com and https://duckduckgo.com/ and do not store your data.
1088
1089One way to circumvent this system so that they dont get your data is through proxies
1090and vpns but everyone knows what they are proxies and VPNs do not know if you just take a look
1091google which has several statutes explaining, but even with proxy
1092and vpns is possible to get through to you trough a reverse of course the person who
1093want to discover your localizção have more gig but only with proxy and you have not vpns
1094is protected more securely to remain anonymous is using a mac + ip cloned
1095and then tunneling ips we go:
1096
1097=======================
10981.8 How to clone a mac
1099=======================
1100
1101First we type in ifconfig terminal
1102
1103root @ cyberhats: # ifconfig
1104eth0 Link encap: Ethernet HW Address 00: 06: 0a: and: dc: 73
1105 UP BROADCASTMULTICAST MTU: 1500 Metric: 1
1106 RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 0
1107 TX packets: 0 errors: 0 dropped: 0 overruns: 0 carrier: 0
1108 collisions: 0 txqueuelen: 1000
1109 RX bytes: 0 (0.0 B) TX bytes: 0 (0.0 B)
1110 IRQ: 45 E / S: 0x2000
1111
1112wlan0 Link encap: Ethernet HW Address 40: 3a: 05: 96: 5a: 10
1113 inet 191.162.1.24 end .: Bcast: 192.168.1.255 Men: 255.255.255.0
1114 inet6 address: fe80 :: 721a: 4ff: fe69: 7a20 / 64 Scope: Link
1115 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1116 RX packets: 36652 errors: 0 dropped: 0 overruns: 0 frame: 0
1117 TX packets: 28333 errors: 0 dropped: 0 overruns: 0 carrier: 0
1118 collisions: 0 txqueuelen: 1000
1119 RX bytes: 39117265 (37.3 MiB) TX bytes: 4597970 (4.3 MiB)
1120
1121ethe0 is the wired network card and its MAC is 00: 03: 0d: and: dc: 96 and wlan0
1122is the wireless network card MAC 40: 3a: 05: 96: 5a: 10
1123
1124To change the MAC first you must smash the wlan0 and then rebuild
1125with the new configs for this utlilizamos the command "ifconfig wlan0 down"
1126
1127root @ cyberhats: # ifconfig wlan0 down
1128
1129Now just change the configs and raise new network very simple to change the mac :)
1130just type the command "ifconfig wlan0 hw ether xx: xx: xx: xx: xx: xx" where xx you put
1131the new Mac you want.
1132
1133root @ cyberhats: # ifconfig wlan0 hw ether 16: cd: 26: ab: 69: f
1134
1135After you use the command "ifconfig wlan0 up" to raise the network and ready.
1136
1137root @ cyberhats: # ifconfig wlan0 up
1138
1139
1140========================
11411.9 As an ip mask
1142========================
1143
1144Mask a ip is a technique widely used in the middle hacker because you can create a
1145mask on top of another which will make it almost impossible to identify you.
1146
1147To mask an IP terminal just type in the command "ifconfig wlan0: 1 xxx.xxx.xxx.xxx"
1148where xxx.xxx.xxx.xxx is the IP that will be masking the true.
1149
1150root @ cyberhats: # ifconfig wlan0: 1 192.158.0.126
1151
1152root @ cyberhats: # ifconfig
1153
1154eth0 Link encap: Ethernet HW Address 00: 06: 0a: and: dc: 73
1155 UP BROADCASTMULTICAST MTU: 1500 Metric: 1
1156 RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 0
1157 TX packets: 0 errors: 0 dropped: 0 overruns: 0 carrier: 0
1158 collisions: 0 txqueuelen: 1000
1159 RX bytes: 0 (0.0 B) TX bytes: 0 (0.0 B)
1160 IRQ: 45 E / S: 0x2000
1161
1162wlan0 Link encap: Ethernet HW Address 40: 3a: 05: 96: 5a: 10
1163 inet 191.162.1.24 end .: Bcast: 192.168.1.255 Men: 255.255.255.0
1164 inet6 address: fe80 :: 721a: 4ff: fe69: 7a20 / 64 Scope: Link
1165 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1166 RX packets: 36652 errors: 0 dropped: 0 overruns: 0 frame: 0
1167 TX packets: 28333 errors: 0 dropped: 0 overruns: 0 carrier: 0
1168 collisions: 0 txqueuelen: 1000
1169 RX bytes: 39117265 (37.3 MiB) TX bytes: 4597970 (4.3 MiB)
1170
1171wlan0: 1 Link encap: Ethernet HW Address 12: ab: 34: cd: 56: f
1172 inet end .: 192.158.0.126 Bcast: 192.168.1.255 Men: 255.255.255.0
1173 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1174
1175See what happened? It will create a mask that hides your real ip
1176and the only address that will be used is masked so you will be protected
1177to create a mask over another just go adding them in the same way
1178the first just go changing the numbers of them to be added other mascaras
1179which will superimposed one on another. Ps: This method does not protect your external ip only internal.
1180
1181root @ cyberhats: # ifconfig wlan0: 1: 2 192.128.0.45
1182
1183root @ cyberhats: # ifconfig
1184
1185eth0 Link encap: Ethernet HW Address 00: 06: 0a: and: dc: 73
1186 UP BROADCASTMULTICAST MTU: 1500 Metric: 1
1187 RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 0
1188 TX packets: 0 errors: 0 dropped: 0 overruns: 0 carrier: 0
1189 collisions: 0 txqueuelen: 1000
1190 RX bytes: 0 (0.0 B) TX bytes: 0 (0.0 B)
1191 IRQ: 45 E / S: 0x2000
1192
1193wlan0 Link encap: Ethernet HW Address 40: 3a: 05: 96: 5a: 10
1194 inet 191.162.1.24 end .: Bcast: 192.168.1.255 Men: 255.255.255.0
1195 inet6 address: fe80 :: 721a: 4ff: fe69: 7a20 / 64 Scope: Link
1196 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1197 RX packets: 36652 errors: 0 dropped: 0 overruns: 0 frame: 0
1198 TX packets: 28333 errors: 0 dropped: 0 overruns: 0 carrier: 0
1199 collisions: 0 txqueuelen: 1000
1200 RX bytes: 39117265 (37.3 MiB) TX bytes: 4597970 (4.3 MiB)
1201
1202wlan0: 1 Link encap: Ethernet HW Address 12: ab: 34: cd: 56: f
1203 inet end .: 192.158.0.126 Bcast: 192.168.1.255 Men: 255.255.255.0
1204 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1205
1206wlan0: 1: 2 Link encap: Ethernet HW Address 12: ab: 34: cd: 56: f
1207 inet 192.128.0.45 end .: Bcast: 192.168.1.255 Men: 255.255.255.0
1208 UP BROADCASTRUNNING MULTICAST MTU: 1500 Metric: 1
1209
1210Now if you do not like to create it manually here's the source of a tool made by b4ckd00r doing all these steps for you:
1211-----------------------------------------
1212#! / Bin / sh
1213ifconfig wlan0 down
1214ifconfig wlan0 down
1215ifconfig wlan0 hw ether 16: cd: 26: ab: 69: f
1216ifconfig wlan0 down
1217ifconfig wlan0 hw ether 16: cd: 26: ab: 69: f
1218ifconfig down
1219ifconfig wlan0: 1 192.158.0.126
1220ifconfig wlan0: 1: 2 50.5.26.10
1221ifconfig wlan0: 1: 2: 3 40.52.86.32
1222ifconfig wlan0: 1: 2: 3: 4 10.15.24.55
1223ifconfig wlan0 up
1224echo Success in operation!
1225----------------------------------------
1226
1227=======================
12282.0 Tunneling ips
1229=======================
1230
1231The tunneling method of ips that will describe here was created by my brother
1232DrakeDoS, is an excelent way to protect your IP. The following steps should
1233be made:
1234
12351 - Enter http://www.cjb.net site
1236
12372 - Go to the http://www.cjb.net/shell.html guide
1238
12393 - Register an account
1240
12414 - Install ssh, if necessary, type in a terminal "sudo apt-get install ssh"
1242
12435 - Start the ssh server, for tunneling, type in an ssh terminal D 127.0.0.1:1085 usuario@shell.cjb.net
1244
12456 - after pressing ENTER ssh asked the registered password.
1246
12477 - download the tollbar FOXY PROXY (Standard), for your firefox.
1248
12498 - open Firefox again, and click the right mouse button on the icon of FOXY PROXY and go to the Options tab
1250
12519 - in the FOXY PROXY Standard window that opened, click Add New Proxy
1252
125310 - opened another window where you must configure the settings such as the IP 127.0.0.1 and port 1085 and and mark SOCKS PROXY?
1254
125511 - on the General tab is possible to name the tunneling and change the icon color indicates that the connection. default name: Tunnel
1256
125712 - after all done, just give ok in both windows FOXY PROXY, and click on the icon of FOXY PROXY with the right mouse button
1258
125913 - and choose the option dwelling on the effects tunneling, in this case exmplo, select the connection "Tunnel"
1260
126114 - Ready tunneling is created. Enjoy! : D
1262
1263This is the set up for him after this is done quizer use him again suffice follow these steps:
1264
12651 - Start the ssh server, for tunneling, type in an ssh terminal D 127.0.0.1:1085 usuario@shell.cjb.net
12662 - open firefox, and click on the icon of FOXY PROXY with the right mouse button, and select the option "Tunnel"
12673 - test the anonymity in http://ipduh.com/anonymity-check/ and ready! :)
1268
1269IMPORTANT NOTE: DO NOT CLOSE THE NECESSARY FOR TERMINAL CONNECTION OR AUTOMATICALLY SSH tunneling SESSA!
1270
1271=================================
12722.1 Sending Emails Anonymously
1273=================================
1274
1275Send email anonymously is a very simple technique that can be very useful for social engineering, bankers
1276use this centuries the technique to catch passwords they send an email asking for the password type adminitracao@bradesco.com
1277the person is a person who does not know this trick will send the password believing that it is really an email
1278Submitted banco.Pode be useful for you to create anonymous accounts so imagine you want to register a
1279website and this piece your email to register in this case you can use an email that self delete 10
1280minutes so keep your anonymity has numerous utilities but no more fla and down to business.
1281
1282Some sites send anonymous form of emails are:
1283
1284Send fake email you can send emails with Message type sup3rm4n@fbi.gov
1285http://emkei.cz/
1286http://deadfake.com/Send.aspx
1287
1288Anonymous emails that do not record anything about you and protect your anonymity:
1289http://www.yopmail.com/en/
1290http://tormail.org/
1291
1292Email that deletes itself after 10 min:
1293http://10minutemail.com/
1294http://10minutemail.net/pt/
1295
1296====================
12972.2 HTTPS Protocol
1298====================
1299
1300With the breakthrough of communication platforms being safe and some other non-
1301was the need to create ways in which encrypted even though third parties to intercept
1302not possess any value, and so was born the https.O https protocol protocol protects you from
1303man in the middle attacks and sniffers allows a more secure connection;)
1304
1305The Tor project created a chamdo application HTTPS EVERYWHERE it is based on the implementation NoScript STS
1306it makes your connection more secure in all websites that support ssl.
1307
1308For more information about it or download it visit the link: https://trac.torproject.org/projects/tor/query?status=accepted&status=assigned&status=needs_information&status=needs_review&status=needs_revision&status=new&status=reopened&groupdesc=1&group=type&max=200&component=EFF-HTTPS+Everywhere&component=HTTPS+Everywhere%3A+Chrome&order=priority&col=id&col=summary&col=component&col=status&col=owner&col=type&col=priority&col=milestone&report=19
1309
1310
1311
1312=====================================
13132.3 Honeypots - The irresistible Pot
1314=====================================
1315 The Honeypots do not have this name for nothing, after all when you are scanning a network and are faced with an outdated, open and / or vulnerable service gives an urge to exploitá it.
1316 Honeypots simulate these services to the attacker this vulnerable but this vulnerability was deliberately imposed by the network administrator through a software, honeypots are systems that show vulnerable, attracting invaders that when connected to the system will be monitorados.Com this , techniques, vulnerabilities and tools are obtained for analysis and protection systems.
1317
1318 "A honeypot exists only to be invaded," said Christian Seifert, executive director of the Honeynet Project.
1319
1320 There are different types of honeypots, they are:
1321
1322 Honeypot Low Interaction - All services and vulnerabilities are simulated and the attacker will never have access to the real system. It's just a fantasy world. In this type of honeypot, the trap can be mounted through programs that simulate vulnerable environments.
1323 * Advantages: An attacker can not get gain privileges and explore other machines on the network.
1324 Disadvantages: A savvy hacker can quickly detect the scam and disconnect the system, but until that happens, the honeypot has recorded some of their activities and network address.
1325
1326 Honeypot High Interaction - This is a real system, for example you install the machine, operating system and vulnerable services and exposes it to the Internet. The most recommended is to have an isolated structure to the honeypot, having no connection with the current network of production or research.
1327 * Advantages: Difficult identification of the trap by the hacker, because it is a real environment, and their actions are sent to another computer, preventing them from being lost if the hacker detonate the operating system.
1328 Disadvantages: Depending on the courtesy vulnerability, a hacker can use other types of attacks and use the real system to invade other hosts.
1329 Simplifying practice it would be like this:
13301 - Mounts to a vulnerable environment for hackers to find and begin exploring the system, thinking it is a real target.
13312 - During the invasion, all the hacker's actions are monitored and can be further used as a pattern of study.
1332
1333Like most attacks on companies has help some internal factor, it may be useful to use honeypots to find out who is sabotaging (deleting, changing).
1334
1335Some honeypots:
1336- Honeyd - LINUX (# apt-get install honeyd)
1337- Valhalla Honeypot - WINDOWS (http://ziggi.uol.com.br/downloads/valhala-honeypot)
1338
1339
1340==============
13412.4 Honeynet
1342==============
1343
1344 Definition 1: A Honeynet is a research tool, which consists of a network designed specifically to be committed and containing control mechanisms to prevent it from being used as the basis of attacks against other networks.
1345
1346Definition 2: A Honeynet is nothing more than a type of honeypot. Specifically, a honeypot is highly interactive, designed to search and obtain information from invaders. It is also known as "honeypot research."
1347
1348Once committed, the honeynet is used to observe the behavior of the invaders, enabling detailed analysis of the tools used, their motivations and exploited vulnerabilities.
1349
1350A honeynet usually contains a network segment with honeypots of different operating systems and provide various applications and services. It also contains robust containment mechanisms, with multiple levels of control, and systems to capture and data collection, and alerting.
1351
1352 There are two types of honeynets: Actual honeynets (or simply honeynets) and virtual honeynets:
1353
1354 * Real honeynets
1355
1356In a real honeynet devices that comprise it, including honeypots, restraint mechanisms, warning and information collection, are physical.
1357
1358As an example, a real honeynet could be composed of the following devices:
1359
1360 * Multiple computers, one for each honeypot. Each honeypot with an operating system, applications and real services installed;
1361 * A computer with a firewall installed, acting as a restraint mechanism and data collection;
1362 * A computer with an installed IDS, acting as a mechanism for alerting and data collection;
1363 * A computer acting as a repository of data collected;
1364 * Hubs / switches and router (if necessary) to provide the honeynet network infrastructure.
1365
1366The advantages of this type are: low cost per device; more fault tolerant (environment is distributed), and the attackers interact with real environments.
1367
1368The main disadvantages are: maintenance more difficult and laborious; need for more physical space for the equipment and the total cost tends to be higher.
1369
1370 * Virtual honeynets
1371
1372A virtual honeynet is based on the idea of ​​having all the components of a honeynet implemented in a small number of physical devices. For this, we normally provide a single computer with an operating system installed, which is the basis for the implementation of virtualization software such as VMware (Virtual Infrastructure Software) or UML (User Mode Linux). The virtualization software enable you to run multiple operating systems with installed applications and services at the same time.
1373
1374The virtual honeynets are further subdivided into two categories: self-containment and hybrids. At first, all mechanisms, including containment, capture and data collection, alerting and honeypots (implemented through a virtualization software) are on a single computer. In the second, containment mechanisms, capture and data collection and alerting run on different devices and honeypots on a single computer with a virtualization software.
1375
1376 * The advantages of virtual honeynets are easier to maintain; need for less physical space for the equipment, and the final cost tends to be lower.
1377
1378The main disadvantages are: high cost per device, because it takes more robust equipment; little fault tolerant (many components concentrated at a single point); virtualization software can limit the hardware and operating system used; the attacker can gain access to other parts of the system, because all share the resources of the same device (in the case of the category of self-restraint), and the possibility of the attacker find that is interacting with a virtual environment.
1379
1380It can be said that a honeynet is characterized as a type of honeypot high interaction developed with the main intuited research, for its operation it is customary to create users, send emails, it generates historical and documents, and all services commonly used in a real production system, aiming this way, ensure that the service itself is not detected by any possible attacker (MARCELO, ANTONIO, 2003).
1381 * A factor to be considered are the problems of false positive and false negative. The false positive is when a problem occurs or the network connection and it ends up being interpreted as an actual attack
1382
1383For more information and mirrors: http://old.honeynet.org/
1384
1385
1386============================
13872.5 Router Security
1388============================
1389
1390
1391Good if this ezine addressing this more focused texts for safety nothing better doque say about networks without fio.Atualmente demand for routers and signal wireless connections are up, with that attackers are more felizes.Uma small observation when we say example: -Here has internet signal?
1392It is not said - here's Wifi.Porque Wi-fi signal was a 'conference' and a union of several companies worldwide to determine signals and equipment standards.
1393Wifi = Wireless Fidelity right here would ask if one has wireless signal.
1394 But without ado we go to the first topic on security in routers;
1395
1396
1397-> Passwords
1398
1399 Soon the more controversial subject = 'c Anyway let's get started, although most of the attacks on wireless networks are not based on brute force but packages that are creating with own software that sniffam that network; Sniff = capture network data, whether corporate network or doméstica.Mesmo being that attacks networks by brute force lost to packet analysis of the we have a pretty strong password when I say strong talk in about at least 8 to 10 digits (MINIMUM) containing
1400the characters in alphanumeric, symbolic etc.
1401 Digging in I.net (this one sign crap) found some interesting links for passwords test as:
1402 -> Https://www.microsoft.com/pt-br/security/pc-security/password-checker.aspx
1403
1404
1405
1406-> Encryption
1407
1408 Network security does not depend only the password, as I said the attack on wireless networks via brute force to lose the packet analysis, that is IF the password is strong will solve only one problem, that even "IF"! .. .
1409 The great precursor security in the "Digital" is the encryption which provided more "comfort" for administrators, presidents of countries, business owners, in short everyone who uses the i.net.
1410 There are several types of encryption in i.net currently running in various applications such as the flow of banking information in e-commerce sites, encryption of critical files for administration of a site like this User and pass.A encryption prensente undoubtedly in all the places that I.net are, but as we are talking about routers will speak only of encryption that are used to encrypt passwords and traffic information over the WAN (Internet structure that can cross states, countries and continentes.A I.net is nothing but a gigantic doque WAN) .good as some already know and others are not four major types of encryption of wireless signals;
1411
1412-> WEP (and its variations);
1413
1414-> WPA (and its variations);
1415
1416-> WPA2 - PSK (and its variations);
1417
1418
1419 Let's start talking about the WEP which is considered today the worst method of encrypting passwords, do not know as yet extinto.Para to be aware of the weakness of this encryption especilizados programs in password cracker can decrypts it in about 4 to 8 minutes this is due to the fact that the encryption method used has already been discovered and implemented in the source code of these tools.
1420
1421
1422 The WPA encryption is coming soon after the WEP encryption with this revolutionized the market at the time it was considered one of the best affordable cirptografias so they could encrypt Internet signals without encryption fio.Esta became more robust with variations that implataram various types figures and stronger methods criptografai but as nothing is perfect managed to discover a vulnerability to break these passwords, is not as fast as the WEP as the WPA and its variations is necessary to achieve a number of intercepted packets so you can make a bruteforce.Para password cracking takes about 1-5 hours depending on each computer and intensity of more or less harsh signal.
1423
1424 After a while then came the WA2 encryption and its variations, this encryption method is current and this day in many routers today use the hash (encryption) WPA.Esta password possesses a very strong data traffic encryption over yet can be broken with a long packet interception and pattern features that attempt to absorb the password to a pattern that is due to the hash through decrypt this estimated time is 4 hours to 12 hours varying from each computer and each tool can increase or decrease the time.
1425
1426
1427-> Channel
1428
1429 Many user who preoculpam with your gateway (router provides WAN connection) seek to know some information but many say they have vme all set up and not prescisa change anything, there channels 1-11 if I am not mistaken, among these channels as are signs of some electromagnetic waves may be interfered with other objects such as channel 6 suffering shock waves between the wireless phone and the channel signal wireless.Um I recommend is channel 11 since it is virtually nil objects to work share this connection.
1430
1431
1432-> Cable eternet
1433
1434 The ethernet cable (in my mind) is the best method to connect to I.net one of the best benefits is that can not be invaded because it does not emit electromagnetic waves to be captured and Switching by routers, another factor also influencing much is not suffering interference appeared with anything because they do not share connection to other devices, unless it has a tefelone wired (DSL) and the ethernet cable connected to an ADSL modem (which is the most common) MAY OCCUR colisçoes of packages but as the TCP protocol is fail-safe in milliseconds it will re-send the package and you will not notice any difference in speed or tráfego.Outra great advantage that the ethernet cable connection provides is that its transport capacity packets per second is far superior to the wireless signals.
1435
1436
1437-> MAC-Adress Restriction
1438
1439 A better encremento in router security is the access restriction by MAC.Este method is to open a wireless connection only to the MAC addresses of each computer, MAC address is the hexadecimal number that each network adapter possesses despite this address can be cloned the attacker will have a very small chance soon hit the MAC's are allowed to connect to the network, thus the attacker gives up to invade the network.
1440 To create this restição you must access your router's menu, paste the ip of your router in the address bar (URL) .If you not score know the address of your router try the defaults below:
1441
1442# 192.168.1.1
1443
1444# 192.168.0.1
1445
1446# 10.0.0.1
1447
1448# 10.1.1.1
1449
1450 If never before connected to your router's panel request that a better study in the subject and will read the ezine again, but the sign should probably be
1451
1452# Admin admin
1453#administrator admin
1454
1455 If you have already being logged in you will need to find the MAC restriction option (there's no way I say because there milharem of all router models with different configurations of interfaces), when asking which MAC address's that can access the wireless signal thought would must go to each computer and get the MAC with the following command:
1456
1457# If windows go at the command prompt and type "ipconfig / all" and will be a similar number to this 00: 00: 00: 00: 00: 00 (but not with these characters).
1458
1459
1460# If you go in linux shell and type "ifconfig" and will be a similar number to this 00: 00: 00: 00: 00: 00 (but not with these characters).
1461
1462 After this just create the rule and ready more a fender on your wireless network, oh and do not forget to change the user and the default password of your router.
1463
1464
1465-> Anti-DDoS and Anti-Scan
1466
1467 With the increasing number of attacks and the growing demand for routers producers place on the entrenched firewalls source code to "facilitate" the life of usuário.Dentre the router's firewall options are blocking ICMP packets and put a maximum number of packets that entram.Existe also an option to modify the packet time and if it exceeds this time he is descartado.Eu recommend always leave these options checked thus it will be a great defense not only for your router but also for your computer that will be partially protected against some scanners.
1468
1469
1470-> DMZ (Demilitarized Zone)
1471
1472
1473
1474
1475 DMZ stands for Demilitarized Zone, which means demilitarized zone. It is a feature that allows you to leave a fully accessible to computer I.net
1476
1477 When using this feature, you can not use the port forwarding (which must disabled). Also, it does not make only one accessible to the Internet, but all computer data can be accessed without restriction, not to any kind of protection to the exposed computer.
1478
1479 It is not necessary to associate an IP port, since the computer is fully exposed. Simply enter the local IP. Also, a single computer can be configured. Access to computer over the Internet is done by writing in the public gateway IP browser.
1480
1481How to configure the DMZ on the router?
1482
1483# 1. In the DMZ tab check the Enable DMZ itel.
1484
1485
1486# 2. DMZ Host IP Address, type the IP of the local computer that will be exposed to the Internet.
1487
1488# 3. Click Apply Changes to save the setting.
1489
1490To put a computer in the DMZ all doors are open. This can be used to provide services such as FTP, email, web, etc.
1491
1492 NOTES:
1493
1494
1495 ### A DMZ does not have firewall protection. the computers that are in the DMZ can not be protected by the firewall. They have to ensure alone. ###
1496
1497 ## An interesting feature is that the routers is that to put a computer in the DMZ all "doors" are immediately opened. This can be used to provide services such as web, ftp, email. ##
1498
1499 ## AI you ask me then why leave my exposed computer? SImples.Pelo fact that he will be the front-line computer that is none of the other computers will be reached, only ele.Quem invade your network will have access only to the computer from the DMZ and to any other, this is due to the fact that the DMZ is a limited zone but that possesses its security at zero, this is the strategy for the attacker think that invaded your network when in fact this stuck in a DMZ. ##
1500
1501
1502=====================================
15032.6 Network Monitoring - Part. II
1504=====================================
1505
1506 Good staff since we are talking about security routers and above quote some tips for the safety of both your internal network and for your gateway or your border between the LAN and the WAN (router) .As nobody likes that wise guys invade our networks especially if it is in order to snnifar frames (data) that travel there or be only to pick up the signal and browse tranquilamente.Caso encryption of your network is weak as we present that is WEP or if your method Data encryption is good (WPA2 and derivations) but your password is weak a simple brute force will break it.
1507
1508 If you follow the security and anonymity parameters I and the sup3rm4n are exposing both connection sockets (http / https) and for firewall rules, proxies to attack data forwarding (diodes, scan), encryption and Rules the availability of frames restriction (data) network for people who are not up to the standards that the MAC address is not allowed and also use a case ids for some unforeseen and to protect the gateways to your network is with a security already at a good level, but have you thought was a well experienced attacker can bypass all this? So you think as I do to detect any attackers on my network.
1509
1510 Simple! There is a nowadays tool for monitoring data that is very interesting both in its operation and in its results as well are direct and do not express any complex information so that it is restricted to only some portion of the population passionate about information security.
1511
1512 # WEL0v3S.I (We love information security *. * // Gay scene but it ta good)
1513
1514 Good will continue, the next tool that I will present to you is a kind of hping mixed with the same ifconfig.Isto! they only detect the ips that are on the network and their MAC addresses, then you think pow big deal this então.Ai you lose;)
1515
1516 The tool is called "fing" they possesses the compatibility with the following operating systems:
1517
1518 * Windows
1519
1520 * Linux
1521
1522 * MacOSX
1523
1524 * IOs
1525
1526 Unfortunately the fast download repository do not have this tool in your database so we have to be downloaded from the site that has been programmed:
1527
1528 Download> http://www.overlooksoft.com/download
1529
1530 Or for the lazy who want to download the terminal follows the commands:
1531
1532
1533 # Wget "http://www.overlooksoft.com/packages/download?plat=lx64&ext=debâ€
1534
1535 Sudo dpkg -i "pacote.deb name"
1536
1537 After installing the fing just go in the shell terminal and type fing it will list the network that you are connected and what ips and MACs are connected.
1538 If you have only one computer on the network will be two IPS and two MACS as they correspond to your computer (of course) and also to your router ie the fing interprets your router and as a computador.Caso wonder if even your computer this ip with that just go on shell terminal and type:
1539
1540Linux: ifconfig
1541Windows: ipconfig
1542
1543 This command will list the IP and MAC of your computer on the network is al so you compare with it in this WHAT fing.Caso interface so you have a computer and appear 3 IPS al start creating rules in iptables to block unfortunate that this invading your network and also make sure that the MAC restriction rule this habilitade and configured correctly.
1544
1545===============================================
15462.7 Network Monitoring - Graphical Interface
1547===============================================
1548
1549 Often some people are not used or do not like to be monitoring your network for command lines and therefore opt for tools that have GUI (graphical user interface for user) of these examples is the Etherape that is similar to a sniffer because it intercepts frames (data) that are going to your gateway (router) for your network card and hence its computador.As advantages of using a network traffic analyzer GUI (graphical user interface) and command line varies from person to person, for example if you are a lover of old desing and more hackudao then you prefer the command line, but if you prefer a more friendly tool that with a few clicks you already finds out about the network traffic then your preference is on tools generally in the GUI type.
1550
1551 Prefer graphical tools is not a problem but it is not really recommended because most tools these days do not value the cute desing but, for what it does for example there scanners cute vulnerabilities but that does not have many tools and is not very open for changes as in the example of angryscan that is used in Windows as a scan mass of certain ports as (23,21,445) / 23 = telnet / ftp = 21/445 = windows file sharing service and also the netifera that is used on Linux systems, and also possesses friendly interface (GUI), netifera is more complete doque the angryscan this is not obvious why but it seems that the best programmers have preferably not very friendly command-line tools and interfaces in terms of desing.
1552 Anyway let's talk about etherape, it is a tool which as I said monitors the network in real time (as I already said) he possesses such a friendly interface that prescisa not be an expert to understand WHAT this traveling on your network card.
1553 First we must install it, fortunately possesses the database tools download system then apt-get to download just run the following commands:
1554
1555 # Apt-get install etherape
1556
1557 # Yum install etherape
1558
1559 OR can then be downloaded by site developers >> http://etherape.sourceforge.net/
1560
1561 After this if not created a link on your menu just go into terminal and type etherape.
1562
1563 So will open an interface that currently does not monitor anything because we still select which of the interfaces should be in "listening". Go capture> interface and soon after that select the interface that you are conectado.Caso not know just go in the shell Linux terminal and enter the following command:
1564
1565 # Ifconfig
1566
1567 It will show you the data of your connection and your network card and also which of the interfaces is connected but to facilitate'll give a prior explanation to facilitate ness of lazy:
1568
1569 # If you are on a wireless connection used its interface will be "wlan0"
1570
1571 # If your internet connection is made by cable (ethernet or coaxal) the interface will be used to "eth0"
1572
1573 # There is a 3 interface that is always on what is the "it" that is the localhost abbreviation, this interface is the traffic all related to your computer sending to your own PC (not it?) For example, you go on terminal linux shell or prompt Dos and type ping -a localhost.Adivinhe who will identify who is the localhost ?? the interface "you" that is when you send an order for himself as ping responsible interface is the "it" .This doubting?
1574 Do this place the following command in your command shell to see what WHAT say is true:
1575
1576 # Linux: ifconfig it down
1577
1578 After doing this you gave a down in the interface "lo" ie you down this interface hung ela.Agora tries to give:
1579
1580 # Ping -a localhost
1581
1582 // What's the matter? 100% packets lost? heheh I told you.
1583
1584 This was the fact that when you dropped the interface "lo" and ran the command ping localhost for directing it tries to identify the interface that is localhost accept responsibility for management, as you dropped this interface it failed to identify and send all apcotes were lost.
1585
1586 Now to put the online interface again:
1587
1588 Linux: ifconfig it up
1589
1590 A tip is also let down in the interface you are using, I do not recommend leaving the "it" in down.Enfim, when you select the interface to be monitors etherape logo is a kind of diagram with different color lines growing according to the number and the connection strength between a machine (NIC), and other service that needs frames.cada etherape transport line symbolizes a service clicking on the lines will appear on the left door and the interface will show the services that are running, and these lines vary their thickness according to the intensity of traffic.
1591 Well, the tutorial on etherape was a bit short because there is not much doque say so fuçe it you will learn and draw how it works, just a tip:
1592 # Do not use the etherape monitoring your network as you browse the internet normally example (youtube.com, google.com and other sites); they make connection with several other servers as a connecting bridge and soon your etherape will be equal to a nightclub (tut tut tut tut).
1593
1594===========================================
1595ENCRYPTION - Part III
1596===========================================
15971.1 Encrypting sensitive data - Truecrypt
1598===========================================
1599
1600 Eae galerinha;) another related topic safety and this is one that I consider very important because even if an attacker goes up by all these barriers and the sup3rm4n I talked it can not catch your most critical data because they will be under strong encryption in hidden file and / or even better on encrypted mobile devices that can be removed and placed the time you want without risk that someone invade your computer and steal your data.The attacker may even be smart and persistent in attack and think as does not possess important information on you computer may be hiding the data for this he can install a keylloger on your machine and be monitoring your computer for 24 hours so you decrypt your data make it the theft of informações.Mas that the attacker has to be knowledgeable and persistent.
1601 First I would say that a son of a bitch said it is impossible to break this encryption truecrypt and that neither the FBI as cia, federal police and nos can not pass this security, to pass directly or is trying to butt heads against strong encryption truecrypt is difficult to break not say impossible after all the Americans who invented several methods and algorithms of encryptions.
1602 An encryption example that is very strong and used in all traffic data on the internet especially in e-commerce sites is the RSA encryption that can be summarized by mathematical formula n = pq this formula seems simple but the key numbers publishes and private are huge prime numbers.
1603
1604 # Let the encryption that are used as truecrypt option: (Note: Information taken from the site truecrypt documentation: www.truecrypt.org/docs/)
1605
1606
1607
1608 ## AES:
1609
1610
1611 The Advanced Encryption Standard (AES) specifies a FIPS encryption algorithm - approved (Rijndael, designed by Joan Daemen and Vincent Rijmen, published in 1998), which can be used by departments and US federal agencies to protect sensitive information cryptographically. TrueCrypt uses AES with 14 rounds and a 256-bit key (ie, AES-256, published in 2001) operating in XTS mode.
1612
1613In June 2003, after the NSA (US National Security Agency) conducted a review and AES analysis, the US CNSS (National Security Systems Committee) announced that the design and strength of AES-256 (and AES - 192) are sufficient to protect classified information up to the level of Top Secret. This applies to all US government departments or agencies that are considering the purchase or use of products that incorporate the Advanced Encryption Standard (AES) to satisfy the security requirements associated with the protection of national security systems and / or national security information.
1614
1615
1616 ## Serpent:
1617
1618 Designed by Ross Anderson, Eli Biham and Lars Knudsen, published in 1998. It uses a 256-bit key, 128-bit block and operates in XTS mode. Snake was one of the finalists of AES. It was selected as the AES algorithm proposed, even seemed to have a greater safety margin than the winning Rijndael. More specifically, Serpent seemed to have a high safety margin, while Rijndael appeared to have only an adequate margin of safety. Rijndael also received some critical suggesting that its mathematical structure can lead to attacks in the future.
1619
1620 The crypto Twofish provides a table of safety factors for the AES finalists. Safety factor is defined as: number of complete cipher rounds divided by the largest number of rounds that was broken. Thus, a broken cipher has the lowest safety factor 1. Serpent had the highest safety factor of AES finalists: 3.56 (for all supported key sizes). Rijndael -256 had a safety factor of 1.56.
1621
1622Despite these facts, Rijndael was considered an appropriate selection for the AES to its combination of security, performance, efficiency, practicality and flexibility. In the last AES Candidate Conference, Rijndael has 86 votes, Serpent has 59 votes, Twofish has 31 votes, RC6 has 23 votes, and MARS has 13 votes.
1623
1624
1625 ## Twofish:
1626
1627 Designed by Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson, published in 1998. It uses a 256-bit key and 128-bit blocks and operates in XTS mode (see Operating Modes section). Twofish was one of the finalists of AES. This figure uses the key-dependent S-boxes. Twofish can be seen as a set of 2128 different encryption systems where 128 bits derived from a key control selection 256-bit encryption system. In the Twofish team says that the S-boxes-dependent key is a form of security margin against unknown attacks.
1628
1629
1630 ## RIPMD-160:
1631
1632 RIPEMD-160, published in 1996, is a hash algorithm designed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel in an open academic community. The size of the RIPEMD-160 output is 160 bits. RIPEMD-160 is an enhanced version of RIPEMD hash algorithm that was developed under the RIPE project of the European Union (RACE Integrity Primitives Evaluation), 1988-1992. RIPEMD-160 was adopted by the International Organization for Standardization (ISO) and the IEC 10118-3: 2004 the international standard ISO / IEC
1633
1634
1635 ## SHA-512:
1636
1637 SHA-512 is a hash algorithm designed by the NSA and published by NIST FIPS PUB 180-2 in [14] in 2002 (the first version was published in 2001). The size of the output of this algorithm is 512 bits.
1638
1639 ## Whirlpoor:
1640
1641 The Whirlpool hash algorithm was designed by Vincent Rijmen (co-creator of the AES encryption algorithm) and Paulo SLM Barreto. The size of the output of this algorithm is 512 bits. The first version of Whirlpool, now called Whirlpool-0, was published in November 2000. The second version, now called Whirlpool-T, was selected for the NESSIE (New European Schemes for Signatures, Integrity and Encryption) portfolio of cryptographic primitives (a project organized by the European Union, similar to the competition AES). TrueCrypt uses the third version (final) of Whirlpool, which was approved by the International Organization for Standardization (ISO) and the IEC 10118-3: 2004 the international standard ISO / IEC.
1642
1643
1644 -> There are encryption merge in order to strengthen data encryption method to be protected, the encryption that were created by encryption merging are:
1645
1646
1647
1648 AES-Twofish ##:
1649
1650Two figures in a cascade operating in XTS mode. Each 128-bit block is first encrypted with Twofish (256-bit key) in XTS mode and then with AES (256-bit key) in XTS mode. Each cascade ciphers uses its own key. All encryption keys are mutually independent (note that header keys are too independent, even if they are derived from a single password - see Header Key Derivation, Salt, and Iteration Count). See above for information on the numbers in individual cascade.
1651
1652 ## AES-Twofish-Serpent:
1653
1654Three figures in a cascade operating in XTS mode. Each 128-bit block is first encrypted with Serpent (256-bit key) in XTS mode, then with Twofish (256-bit key) in XTS mode, and finally with AES (256-bit key) in XTS mode. Each cascade ciphers uses its own key. All encryption keys are mutually independent (note that header keys are too independent, even if they are derived from a single password - see Header Key Derivation section, Salt, and Iteration Count). See above for information on the numbers in individual cascade.
1655
1656 ## Serpent -AES:
1657
1658Two figures in a cascade operating in XTS mode. Each 128-bit block is first encrypted with AES (256-bit key) in XTS mode and then with Serpent (256-bit key) in XTS mode. Each cascade ciphers uses its own key. All encryption keys are mutually independent (note that header keys are too independent, even if they are derived from a single password - see Header Key Derivation section, Salt, and Iteration Count). See above for information on the numbers in individual cascade.
1659
1660 Serpent-Twofish-## AES:
1661
1662Three figures in a cascade operating in XTS mode. Each 128-bit block is first encrypted with AES (256-bit key) in XTS mode, then with Twofish (256-bit key) in XTS mode, and finally, with the Serpent (256-bit key) in XTS mode. Each cascade ciphers uses its own key. All encryption keys are mutually independent (note that header keys are too independent, even if they are derived from a single password - see Header Key Derivation section, Salt, and Iteration Count). See above for information on the numbers in individual cascade.
1663
1664 Twofish-Serpent ##:
1665
1666Two figures in a cascade operating in XTS mode. Each 128-bit block is first encrypted with Serpent (256-bit key) and then with the XTS mode Twofish (256-bit key) in XTS mode. Each cascade ciphers uses its own key. All encryption keys are mutually independent (note that header keys are too independent, even if they are derived from a single password - see Header Key Derivation section, Salt, and Iteration Count).
1667
1668
1669
1670 -> So after getting a few more critical noque concerns encryption standards we first create a hidden file in encrypted truecrypt.Mas, we must first download it from the developer's website >> http://www.truecrypt.org/ downloads
1671 The truecrypt possesses support for the following operating systems:
1672
1673 # Windows
1674
1675 # IOS / Mac
1676
1677 # Linux
1678
1679 After downloading this tool install normally, so let the first step to create a hidden file encrypted:
1680
1681 1- Open the truecrypt.
1682
1683 2- Will open the truecrypt interface that is very easy to messing it is GUI (graphical user interface) very user-friendly.
1684
1685 3- Click on "Create Volume" and select "Create an encrypted file container"
1686
1687 4 Select the option you want "Standard TrueCrypt volume" not hidden file and "Hidden TrueCrypt volume" to create hidden file, I recommend the second option.
1688
1689 5- Let selected the option to "Never save History" and after that click "Select File" after that select the name you you want and click Next.
1690
1691 6 Based on our above you encryption studies should choose the "Encryption Algorithm" and "Hash Algorithm" and click Next
1692
1693 7 Select the size you want your file store, example, if you select a 50 gigabyte file and the encrypted file will aramazenar about 50 gigabytes of data.
1694
1695 8. Select Next and then select the password you want, I recommend using a large password and difficult to understand tools like brute force.Clique Next.
1696
1697 9. Now click on "Format" and wait for the process to end, when you finish all close the window.
1698
1699Ready you already created your hidden file (or not, depending on the choice) encriptado.Agora we access this file to store my critical data such as passwords banks, or logins.
1700
1701 1- open the truecrypt on your home interface.
1702
1703 2- Click "Select File" and select the file you created.
1704
1705 3 Enter the password and after informing wait a little soon after will appear on your desktop a file link for storing files you want to your encrypted file.
1706
1707 4 if you want to browse normally just click exit at the truecrypt and every time you want armanezar the file just drag the icon that is on the desktop.
1708
1709 5- At the time that you want to encrypt your file again (always recommend that store WHAT have to save, decrypts it at the same time) Just click on the icon that'll be minimized in the corner of your screen where is the little icons of applications.
1710
1711 6- You will again appear Truecrypt interface, then you simply click on "Dismount All" and then immediately click exit.
1712
1713 7- Ready you already saved your data safe and shut your encrypted file.
1714
1715 8- Remembering every time you want to open the encrypted file follow the steps mentioned above (except the creation hehehe).
1716
1717
1718================================================== ======================
17191.2 To the wise guys, If you connect the PF beat al ... FUDEU! - Destroying data.
1720================================================== ======================
1721
1722 Everyone knows just click delete by pressing "del" no one destroys 2 gbs file pure database that you just downloaded an important site in 10 seconds, then you do it and gets all felizinho because raided a site, lowered the database just forgot to delete the logs but then you think,
1723
1724 - Not have a problem if I catch the database will be deleted and will not have evidence against me.
1725 Dear friend, excuse the expression but you're stupid.
1726
1727 # First, that as delete an 2GBs file pure information that encrimina you in 10 seconds?
1728
1729 # Second, never leave the logs back they can bring you.
1730
1731 But okay federal arrive at your house and you think you will not have as evidence against you, take your computer and on 10 minutes with a tool that retrieves information, that after all this type of tool is widely used for examining forense.Existem divessos programs for recurperação data, a simple google search takes us to many tools.Por this you have to be very careful when deleting crucial information that may encriminar you, I'll show two tools that can do the "dirty work" for you:
1732
1733 ## Wipe
1734
1735 ## Shred
1736
1737
1738=========
17391.3 WIPE
1740=========
1741
1742
1743 The wipe is a tool in command line used to deface one about 34 times file replacing both its internal character as the characters of the title making this process about 34 vezes.Antes we download it, he's in the repositories of fast download ubuntu like apt-get, for it to install this tool simply run the command:
1744
1745 # Apt-get install wipe
1746
1747
1748 I recommend creating a folder called trash and take all the important information there shortly after the end of the day (or gives you will) you just go in the shell terminal and type:
1749
1750 # Wipe -fr "folder name"
1751
1752 Here are a few options that can be found using the command: -h wipe (NOTE: They are in English)
1753
1754Options:
1755 -a Abort on error
1756 -b <buffer-size-lg2> Set the size of the individual I / O buffers
1757 by specifying its logarithm in base 2. Up to 30 of These
1758 buffers might be allocated
1759 c From the chmod () on write-protected files
1760 D Dereference symlinks (Conflicts with -r)
1761 -e Use exact file size: do not round up file size to wipe
1762 possible junk remaining on the last block
1763 -f Force, ie do not ask for confirmation
1764 -F Do not attempt to wipe filenames
1765 -h Display this help
1766 -i Informative (verbose) mode
1767 -k Keep files, ie do not remove () after overwriting Them
1768 -l <length> Set wipe length to <length> bytes, where <length> is
1769 Followed by an integer K (Kilo 1024), M (mega K ^ 2) or
1770 G (Giga K ^ 3)
1771 -M (L | r) Set PRNG algorithm is filling blocks (and ordering passes)
1772 l Use libc's random () library call
1773 Use the Arcfour encryption algorithm
1774 -o <offset> Set to wipe offset <offset>, where <offset> has the
1775 same format as <length>
1776 -P <Pass> Set number of passes for wiping filename.
1777 The default is 1.
1778 -Q <Number> set number of passes for quick wipe
1779 -q Quick wipe, less secure, four random passes by default
1780 -r Recurse into directories - symlinks will not be Followed
1781 -R Set random device (random seed command or with -S c)
1782 -S (R | c | p) Random seed method
1783 r Read from random device (strong)
1784 c Read from output of random seed command
1785 p Use pid (), clock () etc. (Weakest)
1786 -s Silent mode - Suppresses all output
1787 -T <Tries> Set maximum number of tries for free
1788 filename search; The default is 10
1789 -v Show version information
1790 -Z Do not attempt to wipe file size
1791
1792
1793
1794
1795=====================================
17961.4 Script to clean All Logs
1797=====================================
1798
1799
1800 Below ums script to clear all logs that exist in the operating system.
1801
1802 OBS:
1803
1804 ## First: In the tool you must select to download the wipe (required for operation of the tool)
1805
1806 ## Secondly, if you depend on some system log not score use this tool because it disfigures any log that exist in the system.
1807
1808 ## Terceito: Be careful when you use it if you have some logs-based tool using the script can damage it permanently.
1809
1810
1811
1812
1813 *******************************************************************************************************************
1814
1815#! / Bin / sh
1816
1817#Script BY: Uid0 V 2.0
1818echo -e '\ e [32; 1mScript BY: Uid0 // Version 2.0 \ e [m'
1819echo '____
1820 __- ~~ / ~ ---.
1821 _ / _--- ()
1822 _ / </) \ ___
1823 ==== - Bye Bye Babies --- === ;;;
1824 \ / V 2.0
1825 (_ (\ (> \)
1826 \ _ (_ <> _>
1827 -i :: ~> | - >>
1828 I; | | |>..
1829 <| :: I | i |.>
1830 KBUM ..... ((((^ -))))
1831 -------------------------------------------------- ----------------
18321- Download wipe (necessary to clear log).
18332 Clone MAC
18343- Camouflage internal ip.
18354 Clear logs.
18365 Exit
1837'
1838
1839read Menu
1840
1841if [$ Menu -eq 1]; Then
1842 sudo apt-get -y install wipe
1843 clear
1844 echo -e '\ e [32; 1mComplete.Pressione ENTER to return to Menu \ e [m.'
1845 read
1846clear
1847./script.sh
1848fi
1849
1850if [$ Menu -eq 2]; Then
1851 ifconfig wlan0 down
1852 ifconfig wlan0 hw ether 16: cd: 26: ab: 69: f # 40: 3a: 05: 96: 5a: 10
1853 ifconfig wlan0 up
1854 clear
1855 echo -e '\ e [32; 1mComplete.Pressione ENTER to return to Menu \ e [m.'
1856read
1857clear
1858./script.sh
1859fi
1860
1861if [$ Menu -eq 3]; Then
1862 ifconfig wlan0 down
1863 ifconfig wlan0: 1 55.23.21.3
1864 ifconfig wlan0: 1: 2 90.76.45.2
1865 ifconfig wlan0: 1: 2: 3 192.33.23.57
1866 ifconfig wlan0: 1: 2: 3: 4 87.239.211.23
1867 ifconfig wlan0: 1: 2: 3: 4: 5 97.45.31.174
1868 ifconfig wlan0 up
1869 clear
1870 echo -e '\ e [32; 1mComplete.Pressione ENTER to check the network config \ e [m.'
1871 read
1872clear
1873ifconfig
1874 echo -e '\ e [32; 1mPressione ENTER to exit \ e [m'
1875read
1876clear
1877./script.sh
1878fi
1879
1880if [$ Menu -eq 4]; Then
1881clear
1882 echo -e '\ e [32; 1mLimpando Logs \ e [m'
1883
1884wipe -fr /root/.cache/*
1885
1886wipe -fr /root/.bash_history
1887
1888history -c
1889
1890wipe -fr / var / log / *
1891
1892wipe -f /var/lib/texmf/web2c/pdftex/pdftex.log
1893
1894wipe -f /var/lib/texmf/web2c/pdftex/pdfetex.log
1895
1896wipe -f /var/lib/texmf/web2c/pdftex/latex.log
1897
1898wipe -f /var/lib/texmf/web2c/pdftex/pdflatex.log
1899
1900wipe -f /var/lib/texmf/web2c/pdftex/etex.log
1901clear
1902echo -e '\ e [32; 1M5% complete \ e [m'
1903wipe -f /var/lib/texmf/web2c/updmap.log
1904
1905wipe -f /var/lib/texmf/web2c/metafont/mf.log
1906
1907wipe -f /var/lib/texmf/web2c/luatex/lualatex.log
1908
1909wipe -f /var/lib/texmf/web2c/luatex/luatex.log
1910
1911wipe -f /var/lib/texmf/web2c/luatex/dviluatex.log
1912
1913wipe -f /var/lib/texmf/web2c/luatex/dvilualatex.log
1914
1915wipe -f /var/lib/texmf/web2c/tex/tex.log
1916
1917wipe -f /var/lib/gems/1.8/gems/mongrel-1.1.5/ext/http11/mkmf.log
1918
1919wipe -f /var/lib/gems/1.8/gems/erubis-2.7.0/test/data/users-guide/stderr.log
1920clear
1921echo -e '\ e [32; 1m10% complete \ e [m'
1922wipe -f /var/lib/gems/1.8/gems/bson_ext-1.3.0/ext/cbson/mkmf.log
1923
1924wipe -f /var/lib/gems/1.8/gems/do_sqlite3-0.10.5/ext/do_sqlite3/mkmf.log
1925
1926
1927wipe -f /var/lib/gems/1.8/gems/sqlite3-ruby-1.3.2/ext/sqlite3/mkmf.log
1928
1929wipe -f /var/lib/gems/1.8/gems/erubis-2.6.6/test/data/users-guide/stderr.log
1930
1931wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
1932
1933wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
1934
1935wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
1936
1937wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
1938
1939wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
1940clear
1941echo -e '\ e [32; 1m15% complete \ e [m'
1942wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
1943
1944wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
1945
1946wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
1947
1948wipe -f /var/lib/gems/1.8/gems/json-1.5.3/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
1949
1950wipe -f /var/lib/gems/1.8/gems/json-1.5.3/ext/json/ext/parser/mkmf.log
1951
1952wipe -f /var/lib/gems/1.8/gems/json-1.5.3/ext/json/ext/generator/mkmf.log
1953
1954wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
1955
1956wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
1957
1958wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
1959
1960wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
1961
1962wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
1963
1964wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
1965clear
1966echo -e '\ e [32; 1m20% complete \ e [m'
1967wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
1968
1969wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
1970
1971wipe -f /var/lib/gems/1.8/gems/json-1.5.1/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
1972
1973wipe -f /var/lib/gems/1.8/gems/json-1.5.1/ext/json/ext/parser/mkmf.log
1974
1975wipe -f /var/lib/gems/1.8/gems/json-1.5.1/ext/json/ext/generator/mkmf.log
1976
1977wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
1978
1979wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
1980
1981wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
1982
1983wipe -f /var/log/boot.log
1984
1985wipe -f /var/log/netconf.log
1986
1987wipe -f /pentest/wireless/fern-wifi-cracker/capture_status.log
1988
1989wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
1990
1991wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / raidcall_7.2.8.log
1992
1993wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / proto_7.2.8.log
1994
1995wipe -f /root/.local/share/gvfs-metadata/trash:-358b295d.log
1996
1997wipe -f /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-7e93f4cd.log
1998
1999wipe -f /root/.local/share/gvfs-metadata/archive:host=file%253A%252F%252F%252Ftmp%252Fperl1.zip-034aedeb.log
2000
2001wipe -f /root/.local/share/gvfs-metadata/uuid-ef9aea92-fcde-46b1-a03b-e116fd5cd939-07aceae2.log
2002
2003wipe -f /root/.local/share/gvfs-metadata/root-8e25cce9.log
2004
2005wipe -f /root/.local/share/gvfs-metadata/home-0cd48961.log
2006
2007wipe -f /root/.local/share/gvfs-metadata/archive:host=file%253A%252F%252F%252Ftmp%252F404.zip-aaa48186.log
2008
2009wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2010
2011wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2012
2013wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2014clear
2015wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2016
2017wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2018
2019wipe -f /var/lib/gems/1.8/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2020
2021wipe -f /var/lib/gems/1.8/gems/hpricot-0.8.4/ext/fast_xs/mkmf.log
2022
2023wipe -f /var/lib/gems/1.8/gems/hpricot-0.8.4/ext/hpricot_scan/mkmf.log
2024
2025wipe -f /var/lib/gems/1.8/gems/ffi-1.0.11/ext/ffi_c/libffi/config.log
2026
2027wipe -f /var/lib/gems/1.8/gems/ffi-1.0.11/ext/ffi_c/mkmf.log
2028
2029wipe -f /var/lib/gems/1.8/gems/fxruby-1.6.22/ext/fox16/mkmf.log
2030
2031wipe -f /var/lib/gems/1.8/gems/bson_ext-1.5.2/ext/cbson/mkmf.log
2032
2033wipe -f /var/lib/gems/1.9.2/gems/eventmachine-0.12.10/ext/mkmf.log
2034
2035wipe -f /var/lib/gems/1.9.2/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2036clear
2037echo -e '\ e [32; 1m27% complete \ e [m'
2038wipe -f /var/lib/gems/1.9.2/gems/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2039
2040wipe -f /var/lib/gems/1.9.2/gems/gems/do_sqlite3-0.10.8/ext/do_sqlite3/mkmf.log
2041
2042wipe -f /var/lib/gems/1.9.2/gems/gems/sqlite3-1.3.5/ext/sqlite3/mkmf.log
2043
2044wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
2045
2046wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
2047
2048wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
2049
2050wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2051
2052wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2053
2054wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2055
2056wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2057
2058wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2059
2060wipe -f /var/lib/gems/1.9.2/gems/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2061
2062wipe -f /var/lib/gems/1.9.2/gems/msgpack-0.5.5/ext/msgpack/mkmf.log
2063
2064wipe -f /var/lib/gems/1.9.2/gems/mysql-2.8.1/ext/mysql_api/mkmf.log
2065
2066wipe -f /var/lib/gems/1.9.2/gems/hpricot-0.8.6/ext/fast_xs/mkmf.log
2067clear
2068wipe -f /var/lib/gems/1.9.2/gems/hpricot-0.8.6/ext/hpricot_scan/mkmf.log
2069
2070wipe -f /var/lib/gems/1.9.2/gems/nokogiri-1.4.4/ext/nokogiri/mkmf.log
2071
2072wipe -f /var/lib/gems/1.9.2/gems/erubis-2.6.6/test/data/users-guide/stderr.log
2073
2074wipe -f /var/lib/gems/1.9.2/gems/do_sqlite3-0.10.13/ext/do_sqlite3/mkmf.log
2075
2076wipe -f /var/lib/gems/1.9.2/gems/mysql-2.9.1/ext/mysql_api/mkmf.log
2077
2078wipe -f /var/lib/gems/1.9.2/gems/thin-1.5.1/ext/thin_parser/mkmf.log
2079
2080wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
2081
2082wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
2083
2084wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
2085
2086wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2087
2088wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2089
2090wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2091clear
2092wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2093
2094wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2095
2096wipe -f /var/lib/gems/1.9.2/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2097
2098wipe -f /var/lib/gems/1.9.2/gems/fxruby-1.6.25/ext/fox16/mkmf.log
2099
2100wipe -f /var/lib/gems/1.9.2/gems/ffi-1.0.11/ext/ffi_c/libffi/config.log
2101
2102wipe -f /var/lib/gems/1.9.2/gems/ffi-1.0.11/ext/ffi_c/mkmf.log
2103
2104wipe -f /var/lib/gems/1.9.2/gems/sqlite3-ruby-1.2.5/ext/sqlite3_api/mkmf.log
2105clear
2106echo -e '\ e [32; 1m36% complete \ e [m'
2107wipe -f /var/lib/gems/1.9.2/gems/bson_ext-1.5.2/ext/cbson/mkmf.log
2108
2109wipe -f /var/lib/gems/1.9.2/gems/RedCloth-4.2.5/ext/redcloth_scan/mkmf.log
2110
2111wipe -f /usr/share/doc/openjdk-6-jre-headless/test-i386/mauve_output-hotspot.log
2112
2113wipe -f /usr/share/doc/openjdk-6-jre-headless/test-i386/jtreg-summary-hotspot.log
2114
2115wipe -f /usr/share/doc/openjdk-6-jre-headless/test-i386/mauve_output-zero.log
2116
2117wipe -f /usr/share/doc/openjdk-6-jre-headless/test-i386/jtreg-summary-zero.log
2118
2119wipe -f /usr/share/subterfuge/httpall.log
2120
2121wipe -f /usr/share/subterfuge/sslstrip.log
2122
2123wipe -f /usr/local/etc/raddb/modules/detail.log
2124clear
2125wipe -f /opt/framework/postgresql/postgresql.log
2126
2127wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/eventmachine-0.12.10/ext/mkmf.log
2128
2129wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/pg-0.11.0/ext/mkmf.log
2130
2131wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.3/ext/nokogiri/mkmf.log
2132
2133wipe -fr /pentest/exploits/set/src/logs/set_logfile.log
2134
2135wipe -fr /pentest/web/sslstrip/sslstrip.log
2136
2137wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/mysql-2.8.1/ext/mysql_api/mkmf.log
2138
2139wipe -fr /var/log/boot.log
2140
2141wipe -fr /var/log/netconf.log
2142
2143wipe -fr /pentest/web/sslstrip/sslstrip.log
2144
2145wipe -fr /pentest/exploits/set/src/logs/set_logfile.log
2146
2147wipe -fr /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2148
2149wipe -fr /root/.wine/drive_c/users/root/Application Date / RaidCall / log / raidcall_7.2.8.log
2150
2151wipe -fr /root/.wine/drive_c/users/root/Application Date / RaidCall / log / proto_7.2.8.log
2152
2153wipe -fr /root/.local/share/gvfs-metadata/trash:-457bed85.log
2154
2155wipe -fr /root/.local/share/gvfs-metadata/uuid-ef9aea92-fcde-46b1-a03b-e116fd5cd939-ba502239.log
2156
2157wipe -fr /root/.local/share/gvfs-metadata/home-8fd623a1.log
2158
2159wipe -fr /root/.local/share/gvfs-metadata/root-b32c0d1e.log
2160
2161wipe -fr /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-2e18e11a.log
2162
2163wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/activerecord-2.3.5/test/assets/example.log
2164
2165wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
2166
2167wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
2168
2169wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
2170
2171wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2172
2173wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2174
2175wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2176clear
2177echo -e '\ e [32; 1m40% complete \ e [m'
2178wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2179
2180wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2181
2182wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/json_pure-1.4.2/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2183
2184wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/activeresource-2.3.5/test/debug.log
2185
2186wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/rails-2.3.5/configs/empty.log
2187
2188wipe -f /opt/framework/ruby/lib/ruby/gems/1.9.1/gems/thin-1.2.7/ext/thin_parser/mkmf.log
2189
2190wipe -f /opt/framework/msf3/external/source/vncdll/winvnc/libjpeg/change.log
2191
2192wipe -f /opt/framework/msf3/external/source/meterpreter/source/jpeg-8/change.log
2193
2194wipe -f /opt/metasploit/apps/pro/nginx/logs/error.log
2195
2196wipe -f /opt/metasploit/apps/pro/nginx/logs/access.log
2197clear
2198wipe -f /opt/metasploit/apps/pro/nginx/logs/rpc.log
2199
2200wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/pg-0.13.2/ext/mkmf.log
2201
2202wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2203
2204wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/after_commit_queue-1.0.1/test/dummy/log/test.log
2205
2206wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/after_commit_queue-1.0.1/test/dummy/log/development.log
2207
2208wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2209clear
2210wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/network_interface-0.0.1/ext/network_interface_ext/mkmf.log
2211
2212wipe -f /opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/bundler/gems/pcaprub-8f11633e459a/ext/pcaprub/mkmf.log
2213
2214wipe -f /opt/metasploit/apps/pro/ui/tmp/pids/delayed_job.log
2215
2216wipe -f /opt/metasploit/apps/pro/ui/log/production.log
2217
2218wipe -f /opt/metasploit/apps/pro/ui/log/delayed_job.log
2219clear
2220echo -e '\ e [32; 1m57% complete \ e [m'
2221wipe -f /opt/metasploit/apps/pro/ui/log/thin.log
2222
2223wipe -f /opt/metasploit/apps/pro/engine/prosvc_stdout.log
2224
2225wipe -f /opt/metasploit/apps/pro/engine/license.log
2226
2227wipe -f /opt/metasploit/apps/pro/engine/prosvc_stderr.log
2228
2229wipe -f /opt/metasploit/apps/pro/engine/log/production.log
2230
2231wipe -f /opt/metasploit/apps/pro/engine/config/logs/framework.log
2232
2233wipe -f /opt/metasploit/apps/pro/data/vulndex/vulndex.log
2234
2235wipe -f /opt/metasploit/postgresql/postgresql.log
2236
2237wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/eventmachine-1.0.3/ext/mkmf.log
2238
2239wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/thin-1.5.1/ext/thin_parser/mkmf.log
2240
2241wipe -f /root/.gem/ruby/1.9.2/gems/unf_ext-0.0.6/ext/unf_ext/mkmf.log
2242
2243wipe -f /root/.gem/ruby/1.9.2/gems/typhoeus-0.2.4/ext/typhoeus/mkmf.log
2244clear
2245echo -e '\ e [32; 1m58% complete \ e [m'
2246wipe -f /root/.gem/ruby/1.9.2/gems/ffi-1.9.0/ext/ffi_c/mkmf.log
2247
2248wipe -f /root/.gem/ruby/1.9.2/gems/ffi-1.9.0/ext/ffi_c/libffi-i486-linux/config.log
2249
2250wipe -f /root/.gem/ruby/1.9.2/gems/fxruby-1.6.28/ext/fox16_c/mkmf.log
2251
2252wipe -f /root/.gem/ruby/1.9.2/gems/typhoeus-0.3.3/ext/typhoeus/mkmf.log
2253
2254wipe -f /root/.msf4/logs/framework.log
2255
2256wipe -f /root/.local/share/Trash/files/search.log
2257clear
2258echo -e '\ e [32; 1m60% complete \ e [m'
2259wipe -f /root/.local/share/gvfs-metadata/home-eb800cf1.log
2260
2261wipe -f /root/.local/share/gvfs-metadata/network:-23dd4af9.log
2262
2263wipe -f /root/.local/share/gvfs-metadata/trash:-cd593053.log
2264
2265wipe -f /root/.local/share/gvfs-metadata/root-44ef9687.log
2266
2267wipe -f /root/.local/share/gvfs-metadata/http:uri=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D82V1YOdoD5Q-dc47b835.log
2268
2269wipe -f /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-527992a1.log
2270clear
2271echo -e '\ e [32; 1m65% complete \ e [m'
2272wipe -f /root/.local/share/gvfs-metadata/uuid-f5987f60-4fd5-4558-aa44-d196a3e9e61b-abfcb32f.log
2273
2274wipe -f /root/teamviewer8/logfiles/TeamViewer8_Logfile.log
2275
2276wipe -f /root/teamviewer8/logfiles/startup.log
2277
2278wipe -f /pentest/reverse-engineering/javasnoop/js.log
2279
2280wipe -f /pentest/reverse-engineering/binwalk/file-5.07/config.log
2281
2282wipe -f /pentest/reverse-engineering/binwalk/config.log
2283
2284wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/devirt/devirt.log
2285clear
2286echo -e '\ e [32; 1m70% complete \ e [m'
2287wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/sideeffect/images.log
2288
2289wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/sideeffect/sideeffect.log
2290
2291wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/profiler2/profiler2.log
2292
2293wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/useannotation/useannotation.log
2294
2295wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/profiler/profiler.log
2296
2297wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/jimpleParser/jimpleParser.log
2298clear
2299wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/shimple/shimple.log
2300
2301wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/phase/phase.log
2302
2303wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/phase/images.log
2304
2305wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/faq/faq.log
2306
2307wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/usage/usage.log
2308
2309wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/intro/images.log
2310clear
2311echo -e '\ e [32; 1m85% complete \ e [m'
2312wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/intro/intro.log
2313
2314wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/optimizer/optimizer.log
2315
2316wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/tagclass/tagclass.log
2317
2318wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/createclass/createclass.log
2319
2320wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/addattributes/addattributes.log
2321
2322wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/analysis/images.log
2323
2324wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/analysis/analysis.log
2325
2326wipe -f /var/log/boot.log
2327
2328wipe -f /var/log/netconf.log
2329
2330wipe -f /opt/metasploit/msf3/external/source/vncdll/winvnc/libjpeg/change.log
2331
2332wipe -f /opt/metasploit/msf3/external/source/meterpreter/source/jpeg-8/change.log
2333
2334wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2335
2336wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/pg-0.13.2/ext/mkmf.log
2337
2338wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/thin-1.3.1/ext/thin_parser/mkmf.log
2339
2340wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2341
2342wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/eventmachine-0.12.10/ext/mkmf.log
2343
2344wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/pg-0.13.2/ext/mkmf.log
2345
2346wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/thin-1.3.1/ext/thin_parser/mkmf.log
2347
2348wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2349
2350wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/eventmachine-0.12.10/ext/mkmf.log
2351
2352wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/win32/pg-0.13.2/ext/mkmf.log
2353
2354wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/win32/eventmachine-1.0.0.beta.4/ext/fastfilereader/mkmf.log
2355
2356wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch/win32/eventmachine-1.0.0.beta.4/ext/mkmf.log
2357
2358wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch-old/linux32/pg-0.13.2/ext/mkmf.log
2359
2360wipe -f /opt/metasploit/msf3/lib/gemcache/ruby/1.9.1/arch-old/linux64/pg-0.13.2/ext/mkmf.log
2361
2362wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/gems/erubis-2.7.0/test/data/users-guide/stderr.log
2363
2364wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/pg-0.13.2/ext/mkmf.log
2365
2366wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/thin-1.3.1/ext/thin_parser/mkmf.log
2367
2368wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2369
2370wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux32/eventmachine-0.12.10/ext/mkmf.log
2371
2372wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/pg-0.13.2/ext/mkmf.log
2373
2374wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/thin-1.3.1/ext/thin_parser/mkmf.log
2375
2376wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2377
2378wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/linux64/eventmachine-0.12.10/ext/mkmf.log
2379
2380wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/win32/pg-0.13.2/ext/mkmf.log
2381echo -e '\ e [32; 1m90% complete \ e [m'
2382wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/win32/eventmachine-1.0.0.beta.4/ext/fastfilereader/mkmf.log
2383
2384wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch/win32/eventmachine-1.0.0.beta.4/ext/mkmf.log
2385
2386wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch-old/linux32/pg-0.13.2/ext/mkmf.log
2387
2388wipe -f /opt/metasploit/apps/pro/msf3/lib/gemcache/ruby/1.9.1/arch-old/linux64/pg-0.13.2/ext/mkmf.log
2389
2390wipe -f /opt/metasploit/apps/pro/engine/config/logs/db.log
2391
2392wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkComparison.log
2393
2394wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkYAML.log
2395
2396wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkRails.log
2397
2398wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkPure.log
2399
2400wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkComparison.log
2401
2402wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkRails.log
2403
2404wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/ParserBenchmarkExt.log
2405
2406wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkPure.log
2407
2408wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/json-1.6.5/benchmarks/data-p4-3GHz-ruby18/GeneratorBenchmarkExt.log
2409
2410wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/bson_ext-1.6.1/ext/cbson/mkmf.log
2411
2412wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/pg-0.13.2/ext/mkmf.log
2413
2414wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/thin-1.3.1/ext/thin_parser/mkmf.log
2415
2416wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/nokogiri-1.5.2/ext/nokogiri/mkmf.log
2417
2418wipe -f /opt/metasploit/ruby/lib/ruby/gems/1.9.1/gems/eventmachine-0.12.10/ext/mkmf.log
2419
2420wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2421
2422wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / raidcall_7.2.8.log
2423
2424wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / proto_7.2.8.log
2425
2426wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2427
2428wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / raidcall_7.2.8.log
2429
2430wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / proto_7.2.8.log
2431
2432wipe -f /root/.local/share/gvfs-metadata/home-7502e7d1.log
2433
2434wipe -f /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-5fd768bc.log
2435
2436wipe -f /root/.local/share/gvfs-metadata/root-35067688.log
2437
2438wipe -f / root / .local / share / gvfs-metadata / uuid-ef9aea92-fcde-46b1-a03b-e116fd5cd939-711cb91a.log
2439
2440wipe -f / root / .local / share / gvfs-metadata / home-36b4085d.log
2441
2442wipe -f / root / teamviewer8 / logfiles / TeamViewer8_Logfile_OLD.log
2443
2444wipe -f /pentest/reverse-engineering/android/ded/soot/soot-2.3.0/tutorial/menagerie/menagerie.log
2445
2446wipe -f /pentest/fuzzers/rfuzz/gems/rfuzz-0.9/ext/http11_client/mkmf.log
2447clear
2448wipe -f /pentest/fuzzers/rfuzz/gems/rfuzz-0.9/ext/fuzzrnd/mkmf.log
2449
2450wipe -f /pentest/fuzzers/rfuzz/gems/mongrel-1.1.5/ext/http11/mkmf.log
2451
2452wipe -f /pentest/fuzzers/spike/src/config.log
2453
2454wipe -f /pentest/misc/exiftool/t/images/Geotag.log
2455
2456wipe -f /var/log/boot.log
2457
2458wipe -f /var/log/netconf.log
2459
2460wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2461
2462wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / raidcall_7.2.8.log
2463
2464wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / proto_7.2.8.log
2465
2466wipe -f /root/.local/share/gvfs-metadata/uuid-ef9aea92-fcde-46b1-a03b-e116fd5cd939-711cb91a.log
2467
2468wipe -f /root/.local/share/gvfs-metadata/home-af94a79f.log
2469
2470wipe -f /root/.local/share/gvfs-metadata/uuid-f89766d5-a1b2-4456-89d5-b7aa6e96274d-d99053da.log
2471
2472wipe -f /root/teamviewer8/logfiles/TeamViewer8_Logfile_OLD.log
2473
2474wipe -f /pentest/misc/exiftool/t/images/Geotag2.log
2475
2476wipe -f /pentest/sniffers/darkstat/config.log
2477
2478wipe -f /pentest/telephony/warvox/src/ruby-kissfft/mkmf.log
2479
2480wipe -f /pentest/telephony/warvox/web/log/production.log
2481clear
2482wipe -f /pentest/web/owasp-zap/db/zapdb.log
2483
2484wipe -f /pentest/web/dirb/config.log
2485
2486wipe -f /pentest/voip/artemisa/logs/artemisa_pjsua_2012-06-17.log
2487
2488wipe -f /var/log/boot.log
2489
2490wipe -f /var/log/netconf.log
2491
2492wipe -f /root/.wine/drive_c/Program Files / RaidCall / filetrace.log
2493
2494wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / raidcall_7.2.8.log
2495
2496wipe -f /root/.wine/drive_c/users/root/Application Date / RaidCall / log / proto_7.2.8.log
2497
2498wipe -f /pentest/voip/artemisa/logs/artemisa_2012-06-17.log
2499clear
2500wipe -f /pentest/cisco/cisco-torch/scan.log
2501
2502wipe -f /pentest/wireless/freeradius-wpe/libltdl/config.log
2503
2504wipe -f /pentest/wireless/freeradius-wpe/raddb/modules/detail.log
2505
2506wipe -f /pentest/wireless/freeradius-wpe/config.log
2507clear
2508wipe -f /pentest/scanners/unicornscan/config.log
2509
2510wipe -f /pentest/enumeration/irpas/libpcap-0.4/config.log
2511clear
2512wipe -f /pentest/enumeration/lanmap2/ref/cache-web/cache.log
2513
2514wipe -f /pentest/exploits/rebind/src/termcap/config.log
2515echo -e '\ e [32; 1m100% complete \ e [m'
2516wipe -f /pentest/exploits/rebind/src/readline/config.log
2517clear
2518
2519echo -e '\ e [32; 1mTouch new archives \ e [m'
2520
2521touch / var / log / lastlog
2522
2523touch /var/log/netconf.log
2524
2525touch /root/.bash_history
2526
2527touch /var/log/boot.log
2528
2529touch / var / log / messages
2530
2531touch / var / log / secure
2532history -c
2533wipe -f /root/.bash_history
2534clear
2535echo -e '\ e [32; 1mSearching * .log for / root / Desktop \ e [m'
2536echo -e '\ e [32; 1mPlease Wait ... \ e [m'
2537cd /
2538find -name * .log> /root/Desktop/log.txt
2539 echo -e '\ e [32; 1mComplete.Pressione ENTER to return to Menu \ e [m.'
2540echo -e '\ e [32; 1mBy: Uid0 \ e [m'
2541read
2542clear
2543cd / root /
2544bash script.sh
2545fi
2546
2547if [$ Menu eq 5]; Then
2548clear
2549echo '____
2550 __- ~~ / ~ ---.
2551 _ / _--- ()
2552 _ / </) \ ___
2553 ==== - Bye Bye Babies --- === ;;;
2554 \ / V 2.0
2555 (_ (\ (> \)
2556 \ _ (_ <> _>
2557 -i :: ~> | - >>
2558 I; | | |>..
2559 <| :: I | i |.>
2560 KBUM ..... ((((^ -))))
2561 -------------------------------------------------- ----------------
2562 Coded by Uid0 - 2013
2563 Version 2.0
2564'
2565exit
2566fi
2567
2568
2569
2570************************************************** **********************************************
2571
2572
2573
2574==========
25751.5 Shred
2576==========
2577
2578
2579The shred is even similar to wipe so that as the wipe only makes the process about 34 times in both internal and external files shred makes the process as often as you like! Wonderful it not? It's actually not very good for a NOOB Lammer pdf resolve to do so:
2580
2581 - Oh my God broke into the bakery site I format my pc and destroy the data from my hd'll put it to make the process 50 times to catch anyone.
2582
2583 Yeah man, you will disfigure all HDD data about 50 times correct? In 15 time you do that your HD is already on fire this is due to the fact that the cylinder is made of a very sensitive material and easily combustible and that there is disfigurement of data across the HD need to turn it completely all cylinders at high speed and so it will heating and warming up to catch fire.
2584 I'll stop stalling and then will the commands:
2585
2586
2587 Options:
2588
2589 n = number of recordings
2590
2591 z = resets all reset and no turning back
2592
2593 Other options in English:
2594
2595
2596 -f, --force change permissions to allow writing if Necessary
2597 -n, --iterations = N overwrite N times instead of the default (3)
2598 --random-source = FILE get random bytes from FILE
2599 -s, --size = N shred this many bytes (suffixes like K, M, G accepted)
2600 -u, --remove truncate and remove file after overwriting
2601 -v, --verbose show progress
2602 -x, --exact do not round file sizes up to the next full block;
2603 this is the default for non-regular files
2604 -z, --zero add the final overwrite with zeros to hide shredding
2605 --help display this help and exit
2606 --version output version information and exit
2607
2608
2609
2610-> Command to destroy the partition
2611
2612# Shred -n 4 z / dev / sda
2613
2614* Beware, if your hard drive is IDE PRIMARY MASTER / dev / sda is / dev / hda
2615
2616
2617
2618========================
26191.6 cookies Cloning
2620========================
2621
2622 Well folks we go to another topic, I will now say about cookies.Você cloning know WHAT are cookies?
2623 Are small files that ums site stores on your browser as you prove who accessed certain page or that you are the real owner of conta.Não understand?
2624
2625 Example:
2626
2627 -> You access your email account on google and put in keep me connected to the gmail sure your identity is true he sends a cookie
2628
2629 First you must break into a wireless network so you can sniff What's going on, advise public places or next to companies in sniffer you can PEGR many wireless weakly encrypted and breaks it rapidamente.Após invade wireless recommend using sniffer wireshark that is GUI interface that is is very friendly despite being very complete tambem.Clonar a cookie is similar to clone a MAC.
2630
2631 There are two methods to clone will you present the two most the wireshark is easier, faster and presciso.
2632
2633 First method: The "cloning" can be made with cookie management addons like "Advanced Cookie Manager" on it you can add this addon in your browser to capture cookies that run on sockets (http) network.
2634
2635 Second method: Turn on the wireshark in wireless network that was invaded and soon after you will see a number of packages that are being requested and sent to different servers, these various servers store cookies to catch the cookie gmail, yahoo, facebook, twitter and within other activate wireshark filter to filter HTTP package only because it is hereby (port 80 or 443) that cookies are sent, will appear several packages look in their description related to "cookie" so you get the link just insert it in its url that soon you will clone the cookie and assume the identity of the victim who received the cookie for authenticity certification.
2636
2637
2638
2639================================================== ====
26401.7 Identifying encryption manually - HARDCORE
2641================================================== ====
2642
2643Let's start by listing the simplest and least:
2644
2645
2646 Popular hashes:
2647
2648
2649 MD5
2650 MD4
2651 MD2
2652 sha1
2653 sha256
2654 SHA384
2655 sha512
2656 LM
2657 NT
2658 base_64
2659 rot_13
2660
2661
2662 Less known hashes:
2663
2664crc32
2665crc32b
2666Snefru
2667gost
2668Adler32
2669ripemd128
2670RIPEMD160
2671tiger128 3
2672tiger128 4
2673tiger160 3
2674haval128 3
2675haval128 4
2676haval 256, 3
2677whirlpool
2678Among other various ...
2679
2680
2681 -> Manual recognition methods
2682
2683
2684 ## MD5:
2685
2686 They are always in 32 128-bit character length.
2687
2688 They are always in hexadecimal, use only characters 0-9 and AF
2689
2690
2691 ## SHA1:
2692
2693 They are always in 40 160-bit character length.
2694
2695 They are always in hexadecimal, use only characters 0-9 and AF
2696
2697 ## MySQL 4.1
2698
2699 They are always in 16 64-bit character length
2700
2701 They are always in hexadecimal, use only characters 0-9 and AF
2702
2703 ## MySQL 5.0
2704
2705 They are always 41 characters and always start with an asterisk *
2706 They are always in hexadecimal, use only characters 0-9 and AF
2707
2708 ## MD5 (Wordpress)
2709
2710 They are always 32 characters and always start with $ P $
2711
2712 They are always in hexadecimal, use only characters 0-9 and AZ and az
2713
2714 ## MD5 (phpbb3) - Used in forums.
2715
2716 They are always 32 characters always starts with $ H $
2717
2718 They are always in hexadecimal, use only characters 0-9 and AZ and az
2719
2720
2721=========================
27221.8 End of Ezine
2723=========================
2724
2725So guys come to the end of the ezine took but ended hehe, one can see that there are many techniques and all these techniques can be circumvented or corrected through the advancement of knowledge and technology today many bodies are being funded for the supervision and prevention acts that are considered delituosos.Mas thanks to growing global technological integration index the techniques of prevention and security station in your cyber scope privatized to a population that values ​​the security and privacy of your information circulating on the I.net for this we must disseminate techniques that make all users of I.net can navigate the will privately in their searches WITHOUT THE FUCK OF KNOWING THAT YOU STAY USA VE XVideos then beijokas guys and we hope you have understood what we tried to move the guys, t +
2726
2727Tips, thanks, suggestions, criticisms and any other fucking ->