aLt's Security Blog

Exploit Microsoft Windows 2000 IIS 5.0 IPP ISAPI Vulnerability Click Here  To Download 

Step1: To Install YARA on Ubuntu we need the PCRE and some libraries first:   sudo apt-get install libpcre3 libpcre3-dev   Then we start downloading the YARA source code: $ wget http://yara-project.googlecode.com/files/yara-1.4.tar.gz  $ wget http://yara-project.googlecode.com/files/yara-python-1.4.tar.gz Step2:  Compile and install yara on your linux box.   a) cd yara-1.4     chmod +x -R /root/Desktop/yara-1.4/*    ./configure     make     make check     make install  b) cd ..     cd yara-python-1.4     python setup.py install Step 3: C onvert clamav database to yara http://code.google.com/p/malwarecookbook/source/browse/trunk/3/3/clamav_to_yara.py?r=5 sigtool -u /var/lib/clamav/main.cvd                                     // decompress the database python cla...

Install Clamav And Create Signatures   Step1: Install clamav in ubuntu by following simple steps given below: Edit /etc/apt/sources.list and add a line like this to it: deb http://volatile.debian.org/debian-volatile lenny/volatile main contrib non-free Then run apt-get update &&  apt-get install clamav If you need clamd, you may also want to run   apt-get install clamav-daemon Step2: CVD (ClamAV Virus Database) is a digitally signed container that includes signature databases in various text formats. The header of the container is a 512 bytes long string with colon separated fields: ClamAV-VDB:build time:version:number of signatures:functionalitylevel required:MD5 checksum:digital signature:builder name:build time (sec) sigtool --info displays detailed information about a given CVD file: Signature formats: MD5 The easiest way to create signatures for ClamAV is to use MD5 checksums, however this method can be only used against static malware. MD5...

When using a tool that displays network traffic a more natural (raw) way the burden of analysis is placed directly on the human rather than the application. This approach cultivates continued and elevated understanding of the TCP/IP suite, and for this reason I  strongly  advocate using  tcpdump  instead of other tools whenever possible. An anagram for the TCP flags:  U nskilled  A ttackers  P ester  R eal S ecurity  F olk  ] Show me all URGENT  (URG)  packets... # tcpdump  'tcp[13]  &   32 != 0 ' Show me all ACKNOWLEDGE  (ACK)  packets... # tcpdump  'tcp[13]  &   16 != 0 ' Show me all PUSH  (PSH)  packets... # tcpdump  'tcp[13]  &   8 != 0 ' Show me all RESET  (RST)  packets... # tcpdump  'tcp[13]  &   4 != 0 ' Show me all SYNCHRONIZE  (SYN)  packets...

1: Find MAC address of all available interfaces :                     getmac 2: Find Version of windows Os:                     ver 3:  Find SID using Other method                     whoami /user 4: Find System Information                     systeminfo 5: find SID of window user                     wmic useraccount where name='vishal' get sid 6: Find about wireless adapter and access point available around you:                            netsh wlan show all

There are three different types of Cisco IOS passwords. 1) Cisco IOS type 0 passwords There is a command in Cisco IOS that can be issued to encrypt all passwords in the configuration file. If this command is not entered into the configuration file then all passwords (except for the enable secret password) will appear as plaintext as shown below: username admin privilege 15 password 0 cisco From the above lines in the Cisco IOS configuration file we can see that in this example the user admin has a password of cisco. The above passwords are noted as type 0 (zero) as shown by the zero that precedes the actual password. Type 0 passwords use no encryption. 2) Cisco IOS type 7 passwords  The command that is issued to encrypt user passwords is "service password-encryption" and this command should be entered from the Cisco router configuration mode prompt. If the "service password-encryption" command is issued then all type 0 (zero) passwords are become encrypted  use...

1)  Command to Find Available users on a window box:     net user 2)  Command to add a new user account with a password:     net user /add  Lenny{username} mango{pass} 3)  Command to add an user account to administrator group:     net localgroup administrator Lenny /add 4)  To give the full administrator right to the user,use following command:     net share concfg*C:\/grant:useraccountname,full 5)  The following example adds a user account for a user whose full name is Jay Jamison and whose user  account name is jayj, with logon rights from 8 A.M. to 5 P.M., Monday through Friday (no spaces in time designations), a mandatory password (Cyk4^g3B), and the user's full name:  net user jayj Cyk4^g3B /add /passwordreq:yes /times:monday-friday,8am-5pm /fullname:"Jay  Jamison" 6)  The following example sets the logon time (8 A.M. to 5 P.M.) for Lenny by using 24-hour notation: ...