Loupe.org

2011-05-06T17:34:46Z

Passed!

2011-02-13T04:06:57Z

It took a little over two weeks to get the email, but I finally received the good news - I passed the CISSP! I'm happy I passed and glad to be certified, but mostly I'm relieved that I don't have to study all over again. I prepared for about a month studying several hours a night and on weekends. I took a couple of days off during that month but mostly I studied the whole time. A month seems to be cutting it fairly close compared to what I've been reading about other candidates preparations. At any rate, I'm done with that one!

What's next?

CISSP exam all done. Whew!

2011-01-31T03:24:53Z

Image via Wikipedia

Just finished taking the CISSP exam and all I can say is - whew! Some thoughts just off the top: the toughest part of the exam is the length. It's really, really long. And some of the questions are longish, with a couple of the multiple choice answers that could be correct. You just need to find the one that is MORE correct. That's tough, and really tests limits of your grasp on the concepts.

I can't say too much about the test due to the confidentiality agreement and the ISC(2) code of ethics. I'm feeling pretty good about my chances of passing. I wasn't so sure right after I finished, but the more I think about it the better I feel. We'll see in a couple of weeks!

pactester - a tool to test Proxy Auto Configuration (PAC) files

2010-04-14T16:19:09Z

If you administer a proxy server and utilize a proxy.pac file for automatic client configuration, then you know how difficult it can be to test entries for proper operation. Really, short of loading it up in your browser and testing it, there wasn't much else you could do.

Enter pactester - on the google code page - to the rescue. This handy command line tool will parse your proxy.pac java code and return what each URL or domain will hit, either your proxy or a direct connection. I've used it extensively lately, and all I can say is bravo!

http://code.google.com/p/pactester/

Leeching Wifi - and why you shouldn't

2010-04-12T17:30:27Z

Sure, you might think you're being clever, connecting to that unsecured wifi hotspot. Hey, just checking email, right? They should have secured their wifi if they didn't want me connecting, right?

Beware! The other end of that connection just might be a Karma hotspot, setup by a malcious person, to gather your data and your passwords. Maybe much, much more.

Karma is a wireless sniffer that looks for probe requests from wireless clients. Once it receives a request (which your wireless client sends out all the time), Karma pretends to be the access point that the client is seeking. Karma is fully configurable - it might be a coffee shop name like "Starbuck wireless" or "T-mobile". Looks fine, right? Think again.

Once you join this rogue hotspot, Karma provides all sorts of services. DHCP, DNS, POP3 (mail), HTTP, File sharing, etc. If your internet just broke, that would be good for us. We'd just disconnect, and Karma wouldn't get any of our info. But Karma HAS an active connection to the net, usually, so all your requests eventually make it to the net - after being proxied and collected by Karma, unfortunately.

Karma can even present an SSL certificate to you, masquerading as a secured site. But the certificate will break, and you'll receive an error about an invalid cert. But, studies show that 80% of users just hit OK through SSL certificate errors. Yikes!

(More info about certificate errors here: http://windows.microsoft.com/en-US/windows-vista/About-certificate-errors)

The moral? Ensure you're connecting to the hotspot you're expecting. Check with the barista at coffee shops for the actual SSID of the hotspot.

And never, ever, every click through an SSL certificate error unless you KNOW it's OK. Because it usually aint.

SQL Injection basics

2010-04-11T22:33:12Z

Image via Wikipedia

SQL injection is a technique wherein an attacker tries to manipulate a back end database by loading the front end application - typically a web based application - with SQL statements. SQL is a tool used to access most modern relational databases.

If successful, the attacker can retrieve information, change account info, upload data to tables, drop entire tables or databases.

Attackers will look for a web form of some type, then inputs SQL into the fields until data is returned, or a helpful error message id displayed. Verbose error messages can be very helpful to troubleshoot applications, but they are absolute gold to an attacker.

Often, developers will use JavaScript on the browser (client side) to filter out different characters they don't want sent to the application - but it is all too easy for an attacker to get around this using custom browsers or proxies.

Example attacker code:

select id from users where name = 'Bill'; drop table users;--';

The semicolon will terminate the SQL statement, however there is a second statement that tells the database to drop the table USERS.

Some defense against this type of attack is to identify the user of special characters in logs (;, *), and to block malicious IP addresses from accessing the web application or form.

As you can tell, this is a tough one to defend against - be ever vigilant with checking your logs!

Reset root password on FreeBSD 7.2

2010-03-16T18:57:19Z

Caveat - you will need console access to the box. Not just remote shell, as you will be booting to single user mode.

1. Boot to single user mode

2. Issue the following at the #

   mount -u /
   mount -a

This will mount the root file system read / write. You may receive a warning that you must run FSCK first. If so, go ahead and do that - at the #, issue fsck. Fix all issues. Next, at the prompt, issue:

   passwd

From there you can reset the password.

Editing and VMX file on a virtual machine

2010-02-20T01:11:39Z

Some workaround procedures include steps that require you edit .vmx files.

Note the following important characteristics of this file:

The .vmx file is typically located in the directory where you created the virtual machine.
- In Windows, the default location for the file is usually C:\Documents and Settings\\My Documents\My Virtual Machines\\.vmx.
- In Linux, vmware-cmd -l lists the full path to all registered .vmx files.
The virtual machine actively writes to its .vmx file. Never edit this file while its virtual machine is running.
Changes to the file are usually version specific. If you upgrade, the workaround you implemented may no longer work.

Before you edit the .vmx file:

Always power off the virtual machine.
Make sure you are logged on as a user with the correct permission level to edit the file.
Make a backup copy of the .vmx file. If your edits break the virtual machine, you can roll back to the original version of the file.

Also, make a backup copy of the edited file. If future administrative changes to the virtual machine overwrite your edited version, you can cut and paste the specific section you want from the backup copy into the current file. Do not replace an entire .vmx file with an older backup.

Important for ESX with VirtualCenter: Any manual additions to the .vmx file from ESX 3.x are overwritten by the entries stored in the VirtualCenter database.

If you need to edit a virtual machine's .vmx file, first remove it from VirtualCenter's inventory (right-click it and choose Remove from Inventory). After you edit it, register the virtual machine again from the ESX command line using:

vmware-cmd -s register /vmfs/volumes///.vmx

The represents the datastore name, the represents the directory containing the virtual machine files, and represents the name of the virtual machine files. The following is an example:

vmware-cmd -s register /vmfs/volumes/Storage1/vm1/vm1.vmx

A return code =1 signals success.

Ipod, or Iphone?

2010-02-17T03:48:50Z

Turn your Ipod Touch into an Iphone (almost) with Skype, a headphone set with a microphone, and a wifi connection. Free (!) calls to anyone on your Skype contact list. Suh-weet!

Skype Ipod

Earbud Mic

Creating sockets with Python

2010-02-11T03:47:34Z

Python programming language has a socket object, which you can use to build a network socket. To build a client that connects to a remote host and sends some arbitrary text, utilize the following code.

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('localhost', 4242))
s.send('Some Arbitrary Text')
data = s.recv(1024)
s.close()
print 'Received', 'data'

Now you can connect to this with a netcat listener:

nc -l -p 4242

You should receive "Some Arbitrary Text" as the output. Can you start to see the practical applications? :-)

Simple Tips For Better Password Security

2010-02-02T23:00:05Z

Simple tips for better web password security from Sophos Labs on Vimeo.

Nerdness: Watch the IE exploit that dinged Google in action

2010-01-30T21:59:20Z

The "Aurora" IE Exploit in Action from The Crew of Praetorian Prefect on Vimeo.

Hey, Dad! The Saints are going to the Superbowl!

2010-01-25T23:57:09Z

Hey, Dad. It's been a while, I know, but something happened last night that you're not going to believe. The Saints won the NFC championship and we're going to the Superbowl!

It was unreal, Dad. You've been gone for almost ten years now, and you wouldn't recognize this team. I remember, when I was young, you'd take me to the games. I remember walking into the dome, holding your hand so as not to get lost among the throngs, and marveling at the immensity of it all. The booming voice on the loudspeaker. The deafening roar of the crowds. Just you and me, rejoicing in the wins (few and far between), and suffering the losses. The Saints were a motley crew of cast-offs and has-beens and never will be's. Nobody ever gave us much of a chance. But you'd always make the best of it.

"There's always next year, son." you'd always say. "You gotta believe".

I started playing park ball shortly afterward. You came to every game. I remember, we were playing for the championship one year, and I was pretty worried. The other team was bigger, faster, and hell, their uniforms even looked better. Nobody really gave us much of a chance.

You told me, "On any given day, son, anyone can be beaten." you said. "But you gotta believe."

And you were right, because we won.

This whole season has been amazing, Dad. we'd have had a lot of fun talking about it. I can remember, a few years after those early Saints games, when I had outgrown park ball and discovered beer and cigarettes, when I became a teenager with a bad attitude, we talked less and less. But when we did talk, we always had the Saints. What the chances were. How they were going to do it this year. Always hopeful, but always ending in a disappointment. Nobody ever gave us much of a chance.

And you told me, "Son, you gotta believe."

Well last night it happened. I tell you it was magical. It was close all the way. Tie score for most of the game. I'm not going to lie, it was looking pretty grim there at the end. Favre had it and was driving, getting close to field goal range. The announcers were already talking about how great it would be to see Favre in the Super Bowl. Nobody really gave us much of a chance.

But then I heard your voice say, "You gotta believe."

Then the interception. Oh, my, how the Dome exploded! Then overtime, the drive and the breathless anticipation of the kick. Just for a moment there, time seemed to stretch out in all directions, to infinity and back again, and you were there with me, just for the moment, and the ball went through the uprights and thousands, no - millions of people, black and white, young and old, mothers, daughters, and yes, fathers and sons screamed with one voice. Then it was over except for the crying, the confetti, the exuberent celebration where an entire city that should have been wiped off the map screamed with one voice - "We believe".

I feel weird telling you about all this, because it seems like maybe you were there, somehow? It sure felt like it to me.

Anyway, you've missed a lot since you've been gone. The twin towers fell. LSU won a couple of national titles. Your grand-kids are growing from the toddlers you knew into fine young adults. Hurricane Katrina came and tried to wipe us off the map. A senator even remarked that maybe it would be best not rebuild New Orleans. How we were too uneducated, too poor, too damn stupid to know we were living in a place that was below sea level and we should just abandon the area. Nobody really gave us much of a chance.

But we believed, Dad.

Well, I guess that's about it. Oh, and Dad. One more thing. I read the paper today and they're talking about how great the Colts are. How Peyton Manning is the best QB ever. How the Colts defense is too powerful. How their offense is unstoppable. Nobody's giving us much of a chance.

But you know what?

I believe.

Saints Song Collection

2010-01-20T02:32:02Z

Who Dat Nation THIRTEEN N 1.mp3

How U Like Me Na.mp3

' MY TOWN ' NEW ORLEANS SAINTS ANTHEM.mp3

thesaintsbandwagon.com.mp3

New Orleans Saints WHO DAT NATION THEME - Black & Gold (Who Dat!) - K Gates.mp3

U2 & Green Day - The Saints Are Coming [Live @ Louisiana Superdome. New Orleans 2006].mp3

Bring 'Em to the Dome- New Orleans Saints Anthem.mp3

THIS IS NEW ORLEANS.mp3

Snort tip: Quick suppression technique

2010-01-13T13:33:22Z

If you manage a snort box, you know how much time you spend tuning the thresholds and tweaking the rules. Here's a quick way to search your rules files for sid to suppress in your threshold.conf. This works on BSD, but Linux should be fairly close.

1. Search the all the rules files for a pattern:

for i in `ls /path/to/rules` ; do grep -i "Pattern to search" $i ; done

This should return the line in the rules file with the sid you need to suppress

2. Issue this command to add the suppression to your threshold.conf:

echo suppress gen_id 1, sid_id >> path/to/threshold.conf

Step 1 will grep through all the rules files in the folder for a match on the pattern. Step 2 will add the "suppress" line at the end of your threshold.conf.

Remember to cycle snort initialize the changes!