Information Security Saga

Nice presentation on Enterprise Security

2010-03-09T14:54:00.002+05:30

The presentation consist of worth knowing information about the State of Enterprise Security. Download it from here

ADS Alternate Data Stream.

2010-02-24T10:45:00.005+05:30

Alternate data streams (ADS) are a relatively unknown compatibility feature of NTFS. ADS have the ability to fork file data into existing files without affecting their functionality, or size.

This feature helps an attacker to hide malicious files on victims machine.

In the screenshot below I have created a test.txt file in ADS directory which already contains nc.exe the malicious executable.

Now I will hide the nc.exe using ADS.

As you can see in the screenshot nc.exe is no where in the ADS directory.

Now to see the hidden nc.exe in test.txt:malicious.exe run the command
start ./test.txt:malicious.exe

For more details follow link here

Playing with TOR

2010-02-06T23:14:00.005+05:30

My friend wanted to listen Pandora radio.To make it happen I came across this link and it worked.

How To Use An IP From A Specific Country While Running Tor

Also found some useful information.

Pros and Cons of using Tor

Proxychains Nice tool to scan anonymously.

2010-02-06T21:55:00.007+05:30

Tor is wonderful tool to visit the websites anonymously but what about scanning an IP anonymously.I found this useful tool called as proxychains.

ProxyChains is a tool for TCP tunneling via HTTP/HTTPS and SOCKS4/SOCKS5 proxy servers. It allows to run SSH,VNC,FTP,TELNET or any other program from behind proxy server.

1. To use it first download it from:

http://proxychains.sourceforge.net

2. Now we need to unpack ProxyChains:

hacks# tar -xzvf proxychains-3.1.tar.gz

You should see a directory named proxychain-3.1. Make this new directory your working directory and issue the following commands at your terminal:

hacks/proxychains-3.1# ./configure
hacks/proxychains-3.1# make
hacks/proxychains-3.1# make install

3. Now, it is ready to use.

hacks# proxychains nmap -sS 192.168.0.112

Enjoy the anonymity.

SANS STAR Comprehensive Packet Analysis...Not a Big Deal

2009-09-10T15:59:00.000+05:30

Recently I took the SANS STAR Comprehensive Packet Analysis Exam.This exam is basically targeted for Incident Response analysts, firewall and network administrators, analysts responsible for packet and network analysis and packet stream recovery. I am happy with scoring 100 p c. For the listing visit the link below.

http://www.giac.org/star/listings/Security/556