Compiling tcpdstat on Mac OSX (quick fix)

Quick fix for compiling tcpdstat on Mac OSX (Leopard, although probably works for Tiger too).

If you get this error:

cc -I. -I../libpcap-0.7.1 -DLINUX -D__FAVOR_BSD -D_LARGEFILE_SOURCE=1 -D_FILE_OFFSET_BITS=64 -L../libpcap-0.7.1 -c stat.c
cc -I. -I../libpcap-0.7.1 -DLINUX -D__FAVOR_BSD -D_LARGEFILE_SOURCE=1 -D_FILE_OFFSET_BITS=64 -L../libpcap-0.7.1 -c net_read.c
net_read.c:74:1: warning: "__FAVOR_BSD" redefined
<command line>:1:1: warning: this is the location of the previous definition
net_read.c:149: error: static declaration of ‘packet_length’ follows non-static declaration
tcpdstat.h:415: error: previous declaration of ‘packet_length’ was here
make: *** [net_read.o] Error 1

Edit the net_read.c file and change line 149 from this:

static int packet_length; /* length of current packet */

to this:

int packet_length; /* length of current packet */

Simple eh? Just type “make” again and tcpdstat should compile just fine. Simple fix.

November 29, 2007 | Filed Under apple, compile, compiling, leopard, mac, osx, pcap, tcpdstat | 1 Comment 

NSM Console projected module list

Here’s a list of all the planned modules and completed (struck-out) modules for nsm-console: (if a module is struck out, it’s because I’ve finished making a module for it, it isn’t necessarily in the tarball for download)

Think of any other useful modules? Leave me a comment and let me know!

P.S. I’m also brainstorming for some pcap/real-time network visualization tools, stay tuned!

November 28, 2007 | Filed Under aimsnarf, argus, bro-ids, capinfos, chaosreader, console, flowtag, flowtime, harimau, hash, honeysnap, md5, module, ngrep, nsm, p0f, ra, racount, ragator, rahosts, ruby, script, sha256, snort, tcpdstat, tcpflow, tcpxtract, tshark | 3 Comments 

NSM Console – A framework for running things

Well, I’ve been hard at work for the last couple of days working on a (hopefully) useful tool for aiding in NSM file analysis (for pcap files, live analysis doesn’t work).

Behold! I present NSM-Console! (read more about it here, watch a screencast here)

Download the framework here.
Keep in mind this framework only includes 3 modules (mostly used just for testing)

NSM-Console in a small (< 500 1000 1500 lines) framework for running nsm modules. Essentially, it’s a framework for running things (but we don’t call it that because it sounds like it wasn’t any work :P ). Here’s the breakdown: Read more

November 27, 2007 | Filed Under aimsnarf, analysis, console, framework, hex, module, nsm, pcap, plugin, ruby, script, security | 2 Comments 

First extra package available for Hex 1.0.2! (honeysnap-1.0.6.11)

The first addon packages are now available for Hex (version 1.0.1 or 1.0.2)! I have successfully created a FreeBSD port and a Hex package for the honeysnap project. You can find the files here (navi.eight7.org) until they are put into an official hex repository.

If you only want the port, download the honeysnap-1.0.6.11.tar.gz file (note that this file will require a full /usr/ports tree in order to build any dependencies, make sure you fetch the ports on a Hex install before trying to build from source). Untar the file (I usually put it in /usr/ports/security/honeysnap), enter the directory and issue the following command:

sudo make install

It should automatically build all the dependencies and install honeysnap for you.

If you want a faster way, download the honeysnap-1.0.6.11.tbz package and it’s dependency the py25-setuptools-0.6c7_1.tbz package into the same directory and issue the following:

sudo pkg_add -v ./honeysnap-1.0.6.11.tbz

The setuptools package will automatically be installed as a dependency.

After installation, you should be able to type “honeysnap” and get all the command-line options, happy honeysnap-ing!

As always, if you have any questions or problems, feel free to email me or leave a comment!

P.S. Forgot to mention, the package above will only work for Hex 1.0.*, however, the port (the honeysnap-1.0.6.11.tar.gz file) will work on both Hex 1.0.* and FreeBSD 6.* without a problem. Hopefully I’ll be submitting it to the FreeBSD team for review soon to have it included in the standard ports :)

November 23, 2007 | Filed Under bsd, freebsd, hex, honeypot, honeysnap, package, port, software | 1 Comment 

Joining the Hex Network Security Monitoring LiveCD project

Yep, that’s right, I’m going to be helping out with the Hex LiveCD project. I will hopefully be doing some development for some of the NSM tools and fixing bugs in the CD. In case you don’t know what Hex is, let me give you a little synopsis (from the Trac):

“HeX LiveCD is a Network Security Monitoring (NSM) centric Live CD, built based on the principles of NSM, for analsyst, by analyst. Besides containing most of the popular Open Source NSM tools, the HeX Live CD also contains tools to perform network forensics. This Live CD was built based on the 6.2 Release of FreeBSD, and provides Fluxbox as the default desktop environment. It also includes an installer for installing HeX to hard disk.”

I’m already working on extending the NBF (Network-Based Forensics) offline script to include support for my aimsnarf script. I’m excited about being able to help, hopefully I’ll be able to be useful to the project as well as learning some of the tools I haven’t used before myself :)

Geek00l will be leading the project with enhanced, chfl4gs and others all providing dev support. I was even going to wait until he announced it before writing this post, but he just keeps saying he’ll do it tomorrow ;)

If you’re interested in the project or any of it’s details, feel free to join us on #rawpacket on Freenode for chatting! (I go by the nick dakrone on IRC)

November 20, 2007 | Filed Under bsd, freebsd, hex, livecd, monitoring, network, nsm, security | 2 Comments 

A good set of baseline ipfw firewall rules for Mac OSX

I want to point out the excellent baseline firewall rules posted by rmogull over on his blog. Check them out if you’re looking for a starting point for ipfw rules on OSX. Thanks rmogull!

November 16, 2007 | Filed Under apple, firewall, ipfw, mac, network, networking, osx, rules, security | Leave a Comment 

Compile Ettercap-NG-0.7.3 natively on Leopard Fix

UPDATE 2:
njstaticuser mentioned he would like to know where to get this file below: I believe the file should be in /opt/local/var/macports/build/ – there should be a folder called _opt_local_var_macports_sources_rsync.macports.org_release_ports_<ettercap-ng> where <ettercap-ng> will be something like “net_ettercap-ng” (I don’t know the exact name because it has been cleaned from that directory). Under this directory there will be another directory called “work” and under the work directory will be another directory named after the ettercap dist file. Inside this directory you’ll want to look under src/interfaces/curses/widgets/ for the wdg.h and wdg.c files.

If all else fails, run “sudo find /opt/local/var/macports/build -name "wdg.*" -print” and it should print the locations of the files. NOTE: These files will only exist *after* attempting the build with macports, so attempt to build first (sudo port install ettercap-ng), and then look for the files. Hope this helps!

UPDATE:
After talking to people in IRC, I found the real root of this problem, wdg.h and wdc.h need to have #include <sys/types.h> included at the top of the file. At this time, I recommend you attempt the install using MacPorts by doing sudo port install ettercap-ng, let it fail, then go into the directory containing the macports build source, add the include into the 2 files, then run sudo port install ettercap-ng again, it will succeed and your copy of ettercap should work!

Thanks @ Raim in #macports and dmacks in #fink for helping track this down. You can see the bug here.

Original message below:

This is a continuation of the pthread error that I mentioned in a previous post

I finally got it working natively; you might be familiar with the following error when trying to compile ettercap-ng using either fink or natively:

gcc -DHAVE_CONFIG_H -I. -I. -I../../../../include -I/sw/include -O2 -funroll-loops -fomit-frame-pointer -Wall -I/sw/include -I/sw/include -I/sw/include -I/sw/include -g -O2 -c -o libwdg_a-wdg.o `test -f 'wdg.c' || echo './'`wdg.c
In file included from wdg.c:23:
./wdg.h:189: error: syntax error before 'u_char'
./wdg.h:189: warning: no semicolon at end of struct or union
./wdg.h:190: warning: type defaults to 'int' in declaration of 'border_color'
./wdg.h:190: warning: data definition has no type or storage class
./wdg.h:191: error: syntax error before 'focus_color'
./wdg.h:191: warning: type defaults to 'int' in declaration of 'focus_color'
etc etc, errors go on forever...

Well, after poking around in the code I was able to find where to fix the code so that it would compile. Open the directory src/interfaces/curses/widgets/ and edit the files wdg.c and wdg.h

Change all of the occurrences of “u_char” to “int” in these two files, you should now be able to compile without errors.

DISCLAIMER: I don’t know what kind of effect this will have on the curses interface, it will probably break the curses interface permanently, personally I use the text interface the entire time (so I run configure with --disable-gtk so I don’t have to deal with the hassle of installing the gtk/glib libraries), but at least you are able to compile, right? :P

I’ve tar’d up a patched version of the code and configure script (so you don’t get the pthread error). I am planning on hosting on navi.eight7.org, I will put it up and link to it when I’m able to access the machine (work firewall prevents it).

I’m still getting errors when ettercap tries to forward the packets, but I’m positive they are caused by linking to the wrong version of libnet, that has a different number of arguments to the libnet_write_raw_ipv4() function. If I get a fix I’ll post it here.

November 15, 2007 | Filed Under apple, arp, compile, ettercap, fix, hacking, leopard, osx, security, sniffing | 8 Comments 

Fix for being unable to bootstrap fink on Leopard

If you run into the following error trying to bootstrap fink (I was using version 0.27.8) on Leopard:

./Command/failure......................ok 1/0
./Command/failure......................NOK 24/0# Failed test at ./Command/failure.t line 85.
# ''
# !=
# '0'
./Command/failure......................ok 41/0# Looks like you failed 1 test of 49.
./Command/failure......................dubious
Test returned status 1 (wstat 256, 0x100)
DIED. FAILED test 24
Failed 1/49 tests, 97.96% okay

… snip …

Failed 1/39 test programs. 1/905 subtests failed.
make: *** [test] Error 1
### execution of make failed, exit code 2
phase compiling: fink-0.27.8-41 failed

Edit the following file:

<bootstrap_dir>/t/Command/failure.t
Replace <bootstrap_dir> with the directory you untar’d the fink-0.27.* tarball into.

Comment out line 85 by changing:
cmp_ok( $!, '!=', 0 );
To be:
#cmp_ok( $!, '!=', 0 );

Rebootstrap the fink and it should install without a problem.

Note: This is totally unsupported by the Fink team, and might produce unintended results :) According to the mailinglists, the error seems like it’s actually caused by perl 5.8.8 on Leopard instead of 5.8.6 on Tiger, so the test fails. If you want to install perl 5.8.6, you can link /usr/bin/perl to the older version and it should pass the tests.

November 13, 2007 | Filed Under apple, bootstrap, error, fink, fix, leopard, osx, perl | 3 Comments 

Error installing arpwatch on Mac OSX Fix

Another quickie,

Anyone running into the following error:

$ sudo make install
Password:
/usr/bin/install -c -m 555 -o bin -g bin arpwatch /usr/local/sbin
install: bin: Invalid argument
make: *** [install] Error 67

When trying to install arpwatch, edit the Makefile and replace all the occurrences of “-o bin” with “-o root” and all the occurrences of “-g bin” with “-g wheel”

Hope this helps someone.

November 13, 2007 | Filed Under apple, arpwatch, error, install, makefile, osx | 6 Comments 

aimsnarf version 0.11 released

Yea yea, I know, it’s only been a few hours since the first release. Well, here’s the new release with a couple of major todos taken care of:

Download the script here.

Read about aimsnarf in the previous post about it.

Changes in this version:

Todos:

If you find any bugs, send me a note or leave a comment. If you really want to help, you can send me some pcap data to analyze :)   If you have any feature requests, lemme know!

November 12, 2007 | Filed Under account, aim, dsniff, hacking, linux, mac, monitoring, pcap, programming, ruby, script, security, sniffing, tcpdump, wireshark | 4 Comments 

Next Page →

Bad Behavior has blocked 228 access attempts in the last 7 days.