I had a healthy debate with Mr. Boettcher this week about the merits of doing recon for a pentest. Mr. Boettcher is a heavy duty proponent of it, and I see it as a necessary evil, but not one that I consider important. We hash it out, and find some common ground this week.
People search links:
Spokeo - http://www.spokeo.com/
Pipl - https://pipl.com/
Sec Filings site: http://www.sec.gov/edgar/searchedgar/webusers.htm
Mr. Boettcher made a thing! He created a video that highlights how to install Linux securely in a VM. His next video will be how to setup OWASP's WebGoat to test for vulnerable web apps. He noticed that documentation is a bit sparse, and often contradictory, so he wanted to help other folks who are having issues to get a proper install.
You will need an Network Install ISO of Debian, and you will need either VMware Player or Workstation.
His notes are below... Enjoy!
Secure the Goat #1 - Goat Pen
Create a directory where you will put the VM. We'll call it 'goat'.
Download the Debian Network Install ISO and place it in the 'goat' directory.
Create a 'share' directory inside the goat directory
Place a (test) file in the share directory
In VMware Worstation create a new vm using a Debian ISO and run install
Update the sudoers file
$ su - root
$ update-alternatives --config editor
change to vim.tiny by pressing 2 and enter
$ visudo -f /etc/sudoers
copy the root line and add one for goat user
In order to install vmware tools, we'll need to install these packages
$ sudo apt-get install gcc linux-headers-$(uname -r) make
For the vmware tools install to work properly, these simlinks are required
$ cd /lib/modules/$(uname -r)/build/include/linux
$ sudo ln -s ../generated/utsrelease.h
$ sudo ln -s ../generated/autoconf.h
Insert vmware tools virtual CD
In the workstation menu select vm -> install vmware tools
$ tar -C /tmp/ -zxvf /media/cdrom/VMwarTools...
$ sudo /tmp/VMwareTools.../vmware-install.pl
Show desktop icons
$ gsettings set org.gnome.desktop.background show-desktop-icons true
change resolution in menu at top:
applications/system tools/preferences/system settings/ then 'displays'
in Workstation under vm/settings, set virtual machine shared folder
remove ISO file, take snapshot
This week, we go into a proxy program called "Ratproxy", discussed it's ins and outs. Plus, Mr. Boettcher and I have a discussion about how we as infosec people should work with developers and IT professionals to provide them training and understanding of security concepts.
https://code.google.com/p/ratproxy/
http://blog.secureideas.com/2012/07/how-to-setup-ratproxy-on-windows.html
Ratproxy icon courtesy of honeytech and flicker
Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 3.0
http://creativecommons.org/licenses/by/3.0/
Here is Part 2 of our video for understanding the basics of nmap. I discuss some of the logging output, the scripts found in Nmap, and the output that Nmap gives you for reporting or comparison later.
I really did want to go more into the Lua portion of the scripting engine, and perhaps make a simple script, but time constraints halted that. I hope to get more adept at video creation and hopefully editing, to make a more concise video tutorial.
Nmap target specifications: http://nmap.org/book/man-target-specification.html
http://nmap.org/book/nse-usage.html
Explanation of all Nmap scripts: http://nmap.org/nsedoc/
nmap icon courtesy of insecure.org
This week we take some time to talk about risk management with Josh Sokol. This is part 2 from our interview with him last week... We talk some more about Simple Risk from the POV of Risk Management, licensing/modification of Simple Risk.
Mr. Boettcher and Josh discuss the merits of Qualitative vs. Quantitative Risk Analysis, and which one is better...
We also discuss NIST 800 series guidelines, and how he used those to excellent effect in Simple Risk.
NIST 800 Series docs - http://csrc.nist.gov/publications/PubsSPs.html
Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 3.0
http://creativecommons.org/licenses/by/3.0/
