EmoCheck
GitHub release Github All Releases
Emotet detection tool for Windows OS.
How to use
Download EmoCheck from the Releases page.
Run EmoCheck on the host.
Check the exported report.Distro_debian
Last edited by Steve Beattie 2 years ago
In Stock Debian
AppArmor should be available out of the box in the latest Debian distros. Please see http://wiki.debian.org/AppArmor
To enable the AppArmor in the Debian kernel, add “security=apparmor” to the kernel parameters, like this:
sed -i -e 's/GRUB_CMDLINE_LINUX_DEFAULT="/&security=apparmor /' /etc/default/grub
This sed command results in the following /etc/default/grub line on my system:
GRUB_CMDLINE_LINUX_DEFAULT=“security=apparmor quiet”
Then run
update-grub
Experimental AppArmor on Debian Jessie amd64
Kernel
Obtaining
mkdir -p ~/apparmor/ && cd ~/apparmor/
wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.10.2.tar.xz
tar -xJf linux-3.10.2.tar.xz
cd linux-3.10.2/
Building
cd ~/apparmor/linux-3.10.2/
See if we can reuse the existing kernel configuration (CONFIG_IKCONFIG=y, CONFIG_IKCONFIG_PROC=y):
cp /proc/config.gz ./ && gzip -d config.gz
Tweak the kernel, enable AppArmor:
apt-get install libncurses-dev
make menuconfig
“Security options” ---> “AppArmor support”, “Enable AppArmor 2.4 compatability”
Installing
aptitude install dpkg-dev bc
cd ~/apparmor/linux-3.10.2/
make deb-pkg
dpkg -i ../linux-firmware-image_{version}.deb
dpkg -i ../linux-headers-{version}.deb
dpkg -i ../linux-image-{version}.deb
If the kernel is installed on another host, then symlinks for DKMS should be fixed.
rm /lib/modules/{version}/build; ln -s /usr/src/linux-headers-{version} /lib/modules/{version}/build
rm /lib/modules/{version}/source; ln -s /usr/src/linux-headers-{version} /lib/modules/{version}/source
About dpkg -i ../linux-libc-{version}.deb: /usr/include/x86_64-linux-gnu/asm seems to be missing from latest linux-libc-{version}.deb. If you installed linux-libc-{version}.deb, you can downgrade to Debian version with aptitude install linux-libc-dev=3.0.0-3.
Finally:
update-grub
Checking
Reboot under new kernel:
/sbin/shutdown -r now
or
reboot
Now see if AppArmor is loaded and enabled (should print “Y”):
cat /sys/module/apparmor/parameters/enabled
Tools
aptitude install apparmor apparmor-profiles
/etc/init.d/apparmor restart
Checking
cat /var/log/audit/audit.log | grep apparmor_parser
should display something like
type=AVC msg=audit(1316949034.097:108): apparmor=“STATUS” operation=“profile_load” name=“/bin/ping” pid=5207 comm=“apparmor_parser”
Tuning logs
Audit data by default is dropped into /var/log/messages via rsyslogd. That way, the data is severely capped by the kernel in order not to overload the messages log. To make audit data usable with AppArmor we should install auditd and tune it to keep large amounts of data:
apt-get install auditd
sed -i -re 's/max_log_file = [0-9]+/max_log_file = 200/' /etc/audit/auditd.conf
/etc/init.d/auditd restart
Sécuriser OpenSSH
21 Aug 2020
Sshd est le processus du serveur OpenSSH.
Il écoute les connexions entrantes à l’aide du protocole SSH et agit comme serveur pour le protocole.
Il gère l’authentification des utilisateurs, le chiffrement, les connexions de terminaux, les transferts de fichiers et le tunneling.
Home SSH Hardening Guides Contact
About
This free tool audits the configuration of an SSH server or client and highlights the areas needing improvement.
Too many admins overlook SSH configuration when setting up new systems. Unfortunately, the defaults for many operating systems are optimized for compatibility, not security.
To see a sample report, click here.
Multiple vulnerabilities found in Wireless IP Camera (P2P) WIFICAM cameras and vulnerabilities in custom http server
TL;DR: by analysing the security of a camera, I found a pre-auth RCE as root against 1250 camera models. Shodan lists 185 000 vulnerable cameras. The "Cloud" protocol establishes clear-text UDP tunnels (in order to bypass NAT and firewalls) between an attacker and cameras by using only the serial number of the targeted camera. Then, the attacker can automaticaly bruteforce the credentials of cameras.
Product Description
The Wireless IP Camera (P2P) WIFICAM is a Chinese web camera which allows to stream remotely.
shhgit finds secrets and sensitive files across GitHub (including Gists), GitLab and BitBucket committed in near real time.
secu ssh git password leaks
IP Leak Test DNS Leak Test What is my IP?
DNS leak test
What is a DNS leak?
What are transparent DNS proxies?
How to fix a DNS leak
We collect and share information about different bots (user-agents) that you may see visiting your site. If you have noticed a bot that you are not familiar with, search our database of bots. We list many bots that were reported as bad bots and provide as much information as we can about the bots we list.
The Mozilla Observatory has helped over 170,000 websites by teaching developers, system administrators, and security professionals how to configure their sites safely and securely.
Scan your site
Exploits of the week
Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)
Code Blocks 20.03 - Denial Of Service (PoC)
WebPort 1.19.1 - 'setup' Reflected Cross-Site Scripting
WebPort 1.19.1 - Cross Site Scripting
Frigate 2.02 - Denial Of Service (PoC)
Responsive Online Blog 1.0 - 'id' SQL Injection
Trend Micro Web Security - Remote Code Execution
Lansweeper 7.2 Default Account / Remote Code Execution
Student Enrollment 1.0 - Remote Code Execution
FileRun CVE-2019-12905 - Cross Site Scripting
About us
Report URI was founded to take the pain out of monitoring security policies like CSP and other modern security features. When you can easily monitor what's happening on your site in real time you react faster and more efficiently, allowing you to rectify issues without your users ever having to tell you.
Our platform is constantly evolving to help you, our users, better protect your users.
Robots.txt
Introduction au protocole d'exclusion des robots
Le protocole d'exclusion des robots, plus connu sous le nom de robots.txt, est une convention visant à empêcher les robots d'exploration (web crawlers) d'accéder à tout ou une partie d'un site web.
Le fichier robots.txt, à placer la racine d'un site web, contient une liste de ressources du site qui ne sont pas censées être explorées par les moteurs de recherches. Ce fichier permet également d'indiquer aux moteurs l'adresse du fichier sitemap.xml du site.
Par convention, les robots consultent le fichier robots.txt avant d'explorer puis d'indexer un site Web. Lorsqu'un robot tente d'accéder à une page web, comme par exemple http://www.mon-domaine.fr/page.html, il tente d'accéder en premier lieu au fichier robots.txt situé à l'adresse http://www.mon-domaine.fr/robots.txt
Comment créer le fichier robots.txt
Le fichier robots.txt doit être placé obligatoirement à la racine de votre site ; si celui-ci est placé dans un répertoire par exemple, les moteurs ne le découvriront pas et ne suivront pas ses règles et paramètres. Par ailleurs, le fichier doit être d'une taille inférieure à 62 Ko (cf. Taille maximale du fichier robots.txt).
Si le domaine de votre site est http://www.mon-domaine.fr/, le fichier robots.txt doit se situer obligatoirement à l'adresse suivante http://www.mon-domaine.fr/robots.txt
A noter qu'il est également nécessaire que le nom du fichier robots.txt soit en minuscule (pas de Robots.txt ou ROBOTS.TXT).
Voir également les ressources pour la création d'un fichier robots.txt sur un serveur en HTTPS ou dans le cas de sous-domaines.
Le contenu du fichier robots.txt
Exemple de contenu d'un fichier robots.txt :
User-agent: *
Disallow:
Portsentry : Sécurisez votre serveur Linux contre les tentatives d'intrusion !
par Ludovic Toinel il y a 6 jours
3 min de lecture
Is BGP safe yet? No.
Border Gateway Protocol (BGP) is the postal service of the Internet. It’s responsible for looking at all of the available paths that data could travel and picking the best route.
Unfortunately, it isn’t secure, and there have been some major Internet disruptions as a result. But fortunately there is a way to make it secure.
ISPs and other major Internet players (Comcast, Sprint, Verizon, and others) would need to implement a certification system, called RPKI.
Shell script escape injection
echo -e '#!/bin/sh\n\necho "evil!"\nexit 0\n\033[2Aecho "Hello World!"\n' > script.sh
chmod a+x script.shThe resulting script.sh will then work on (has been tested on):
Linux (gnome-terminal, xterm, aterm)
Mac OS (Terminal 2.0, iTerm2)
Cygwin (Windows)Python script escape injection
echo -e '#!/usr/bin/python\n\nprint "evil!";\nexit(0);\n#\033[2A\033[1Dprint "Hello World!";\n' > script.py
chmod a+x script.pyThe resulting script.py will then work on (has been tested on):
Linux (gnome-terminal, xterm, aterm)
Mac OS (Terminal 2.0, iTerm2)
Cygwin (Windows)Batch (Command Prompt) escape injection
echo -e '@echo off\n\r\n\recho evil!\r\n::\033[2D \033[A\033[2Decho Hello World!' > script.batThe resulting script.bat will then work on (has been tested on):
Windows 10 PowerShell
Windows 10 Command PromptPS1 (PowerShell) escape injection
echo -e 'write-host "evil!"\r\n#\033[A\033[2Dwrite-host "Hello World!"' > script.ps1The resulting script.ps1 will then work on (has been tested on):
Windows 10 PowerShell
Windows 10 Command PromptConclusion
As we have seen in this article, terminal escape injections affect practically every modern operating system environment and they can be really nasty.
As infosec professionals, we should know about them and keep our guards up when it matters. Hopefully this article provided enough information to stay safe.
Please feel free to let us know in the comment section your thoughts.
Ne pas copier coller n'importe quel texte de source inconnue
pirate
!! Ne pas copier/coller des sources inconnues dans votre terminal SSH
On a tous un jour copier ne serait-ce qu'un git clone ou un bout de script (ou même une toute petite ligne de commande) sur une page/article d'un site , malheureux qu'a tu fais ...
Ne sais tu pas que le texte que tu vois ne correspond pas fatalement au code qu'il renvoie
PasswordSecurity.info
Put a password in this box:
Accounts
8,165,160,541
Leaks
810
Leaked accounts per day
879,875
Is someone spying on you?
Everyday personal data is stolen in criminal cyber attacks. A large part of the stolen information is subsequently made public on Internet databases, where it serves as the starting point for other illegal activities.
With the HPI Identity Leak Checker, it is possible to check whether your email address, along with other personal data (e.g. telephone number, date of birth or address), has been made public on the Internet where it can be misused for malicious purposes.