Using SMB to access a windows machine through port 139/445 is great, but how can this be used to exploit the system?I know this is gonna get flamed for the nature of hacking, but i'm trying to pen my own windows box with my sec spin of fedora (tried backtrack but didnt like the feel of it, so got the GNOME-security spin)I'm trying to find a way to open up c$ without sitting at my win box and sharing it.
"...The Fedora Security Spin provides a safe test environment to work on security auditing, forensics, system rescue and teaching security testing methodologies in universities and other organizations. The spin is maintained by a community of security testers and developers. It comes with the clean and fast LXDE Desktop Environment and a customized menu that provides all the instruments needed to follow a proper test path for security testing or to rescue a broken system. The Live image has been crafted to make it possible to install software while running, and if you are running it from a USB stick created with the LiveUSB Creator's overlay feature, you can install and update software and save your test results permanently..."
I've been trying to get Security Spin up and running (after having tried unsuccessfully with knoppix STD). I need to be able to connect to my home network, or hell any wireless network.I've tried using iwconfig wlan0 as well as the options in the Network Configuration panel as well as other related panels. I'm able to change and set up profiles for the wireless card, but not to activate them. The button just isn't clickable.If it helps, I'm running Security Spin from a unetbootin usb drive. The wireless card is identified by the system as "Intel Corporation PRO/Wireless 4965 AG or AGN [Kedron] Network Connection" .
Anyone know if the collection of STD tools have been included in Fedora repositories? Would love to recreate a STD disk based off of F12+ live cd and those tools. (Knoppix Secuity Tools Disk that seem to have died out a couple years back) Great tools, just the distro doesnt support new hardware....but if in a F12+package......all would be good.
I am currently running a 64-bit Fedora 14 server which hosts a game server, a voice server, and remote desktop functionality, each on a distinct TCP port. I am currently using the built-in firewall to deny all traffic other than ICMP ping/pong and TCP traffic on those specific ports.I am looking for a graphical application which will let me monitor any connections being made to my server in order to keep an eye out for possible security concerns. To be more specific, I'd like to be able to see the source IP addresses, TCP/UDP ports, and individual bandwidth in use by external connections being made to the server, along with any other information that might be helpful in identifying a possible intrusion attempt.
how efficient and effective are these snort, argus, ossec etc etc for an organization having 3500 PC Network, connected through 700+ Cisco Devices (Layer 2 and Layer 3), and scattered on 130 different sites (geographically)? what should be the combination of products and what should be the architecture for an efficient forensics activity?
I was under the impression the Linux (in my case the Fedora OS) is very secure. However I've learnt with deep concern that that one can have access to the system during system startup i.e one can give various startup directives and bypass the normal login UI to have direct root access.
Is there a way to disble this so that the directives during startup are fixed and cannot be altered. I would like to make the system secure to the maximum extent possible.
iam working on mail server in redhat centos. i want to know how to secure my mail server for heavy loading , any monitoring tools in GUI or console , is any essential tool which is used in Like MNC for mail server..
i know few command in like top,netstat,etc through google but i willing to know some more
Quote: The importance of security should never be underestimated. The consequences of losing data can be disastrous for any organisation. For example, the loss of a single unencrypted laptop may have huge repercussions. This could include breaching data protection legislation with the risk of a significant fine, a loss in the confidence of an organisation, as well as the risk that sensitive data may fall into the hands of a competitor or third party with malicious intent.
I can't get respond through normal channels, all I can use is my phone. My keyboard is disabled. My PC is pretty much a paper weight. Both of them. The only way they could be getting in is through the wifi. I don't know if there is anything I can do. My recovery programsare not accessible. Even onstartup. Is it possible to clear the hard drive another way? I've heard fire purifies, I couldn't get another disc to boot up to reinstall ubuntu. Please text me any ideas, but please be specific with command lines, I have trouble with all the () and / [ and where they go.
I have been setting up multiple security system in the area and was wondering what was the easiest way is to get the camera information that one would need in setting up survellance systems like zoneminder. I use xawtv for testing and
PHP Code: zmu -d <device_path> -q -v
But how can I get specific information about NTSC/PAL cameras or IP cameras. In other words is there a specific tool for that purpose? I can see my video cameras fine using xawtv -c /dev/video but can I look at those log files to see what setting it used for the cameras
Its been two days over, after my search started . But I didn't find answer any where ?. I need to call chroot as part of normal user, but to my surprise it can only be called by SUper user with CAP_SYS_CHROOT capabilities. I am not sure how to add this capability to my user .
I am searching that how i can configure syslogs/rsyslog to receive third party tools or softwares logs. For example i have a program that generates logs like when it is started and logs about its services, alerts if there are any alarms etc. I want to forward these logs using syslogs/rsyslog. Is their any possibility how can i achieve that
Is there a firewall installed and running in 10.04? If so are there any gui tools for configuring it and where are they? If there is not a firewall, what should I install to get one properly up and running?
I've been using pdfTk to encrypt PDFs for distribution to unsophisticated users (that is, users without PGP keys or the will to get one). RC4 encryption, although reasonably adequate for my use, is relatively insecure. I would be more comfortable with AES. Have any gnu tools emerged that implement AES within a PDF container?
Strange thing happend two days ago. I just wanted to reboot my computer and now I'm no longer able to boot o0. My system is runnig with a full encryption with luks/cryptsetup. I'm using a passphrase to unlock my first partition and it will unlock the others by itself. So far so good. But now it doesnt work anymore... I'm not sure what I did before, but what I know, I didn't change anything! about cryptsetup. I did only a little "update" with the recommended packages from the repositories (guess only 4-5 updated)
I already checked with live cd and same thing there. Not able to unlock any device (what seems strange to me, cause there are 4 of them and all corrupted at the same time...?)
I always get the error message: unlock failed, bad password or options? (on boot) Command failed: No key available with this passphrase (live cd)
First thing I did was checking wheter all modules are loaded:
Code: ubuntu@ubuntu:~$ lsmod Module Size Used by sha256_generic 11580 0
The default Firewall ufw is not enabled by default at the time of installation and it has to be enabled by the user.Isn't this a security risk or is the user whether ufw is enabled or not secured from external threats?I am not much knowledgeable about network security But I am trying to understand the Ubuntu mentality behind this default setting.
this is the allert i got:Code:Summary:Your system may be seriously compromised! /usr/sbin/NetworkManager tried to loada kernel module.Detailed Description:SELinux has prevented NetworkManager from loading a kernel module. All confinedprograms that need to load kernel modules should have already had policy writtenfor them. If a compromised application tries to modify the kernel this AVC willbe generated. This is a serious issue.Your system may very well be compromised.Allowing Access:Contact your security administrator and report this issue.Additional Information: