:wq - blog » bsd http://writequit.org/blog Tu fui, ego eris Mon, 22 Dec 2014 14:54:59 +0000 en-US hourly 1 http://wordpress.org/?v=4.1.5 First extra package available for Hex 1.0.2! (honeysnap-1.0.6.11) http://writequit.org/blog/2007/11/23/first-extra-package-available-for-hex-102-honeysnap-10611/ http://writequit.org/blog/2007/11/23/first-extra-package-available-for-hex-102-honeysnap-10611/#comments Fri, 23 Nov 2007 20:27:18 +0000 http://writequit.org/blog/?p=91 The first addon packages are now available for Hex (version 1.0.1 or 1.0.2)! I have successfully created a FreeBSD port and a Hex package for the honeysnap project. You can find the files here (navi.eight7.org) until they are put into an official hex repository.

If you only want the port, download the honeysnap-1.0.6.11.tar.gz file (note that this file will require a full /usr/ports tree in order to build any dependencies, make sure you fetch the ports on a Hex install before trying to build from source). Untar the file (I usually put it in /usr/ports/security/honeysnap), enter the directory and issue the following command:

sudo make install

It should automatically build all the dependencies and install honeysnap for you.

If you want a faster way, download the honeysnap-1.0.6.11.tbz package and it’s dependency the py25-setuptools-0.6c7_1.tbz package into the same directory and issue the following:

sudo pkg_add -v ./honeysnap-1.0.6.11.tbz

The setuptools package will automatically be installed as a dependency.

After installation, you should be able to type “honeysnap” and get all the command-line options, happy honeysnap-ing!

As always, if you have any questions or problems, feel free to email me or leave a comment!

P.S. Forgot to mention, the package above will only work for Hex 1.0.*, however, the port (the honeysnap-1.0.6.11.tar.gz file) will work on both Hex 1.0.* and FreeBSD 6.* without a problem. Hopefully I’ll be submitting it to the FreeBSD team for review soon to have it included in the standard ports :)

]]> http://writequit.org/blog/2007/11/23/first-extra-package-available-for-hex-102-honeysnap-10611/feed/ 1 Joining the Hex Network Security Monitoring LiveCD project http://writequit.org/blog/2007/11/20/joining-the-hex-network-security-monitoring-livecd-project/ http://writequit.org/blog/2007/11/20/joining-the-hex-network-security-monitoring-livecd-project/#comments Tue, 20 Nov 2007 18:08:10 +0000 http://writequit.org/blog/?p=90 Yep, that’s right, I’m going to be helping out with the Hex LiveCD project. I will hopefully be doing some development for some of the NSM tools and fixing bugs in the CD. In case you don’t know what Hex is, let me give you a little synopsis (from the Trac):

“HeX LiveCD is a Network Security Monitoring (NSM) centric Live CD, built based on the principles of NSM, for analsyst, by analyst. Besides containing most of the popular Open Source NSM tools, the HeX Live CD also contains tools to perform network forensics. This Live CD was built based on the 6.2 Release of FreeBSD, and provides Fluxbox as the default desktop environment. It also includes an installer for installing HeX to hard disk.”

I’m already working on extending the NBF (Network-Based Forensics) offline script to include support for my aimsnarf script. I’m excited about being able to help, hopefully I’ll be able to be useful to the project as well as learning some of the tools I haven’t used before myself :)

Geek00l will be leading the project with enhanced, chfl4gs and others all providing dev support. I was even going to wait until he announced it before writing this post, but he just keeps saying he’ll do it tomorrow ;)

If you’re interested in the project or any of it’s details, feel free to join us on #rawpacket on Freenode for chatting! (I go by the nick dakrone on IRC)

]]> http://writequit.org/blog/2007/11/20/joining-the-hex-network-security-monitoring-livecd-project/feed/ 2 Introducing ‘aimsnarf.rb’ => A simple AIM sniffing tool written in Ruby http://writequit.org/blog/2007/11/12/introducing-aimsnarfrb-a-simple-aim-sniffing-tool-written-in-ruby/ http://writequit.org/blog/2007/11/12/introducing-aimsnarfrb-a-simple-aim-sniffing-tool-written-in-ruby/#comments Mon, 12 Nov 2007 19:06:05 +0000 http://writequit.org/blog/?p=84 [UPDATE 11/13/07] : version 0.11 released

Firstly, download the script here.

aimsnarf.rb is a small (~200 lines) Ruby script that I’ve written to sniff and dump AOL IM messages to STDOUT. I wrote this an as alternative to aimsniff, because I really dislike having to install aimsniff and all of it’s dependancies when all I want is a simple text transcript. I really felt like the dsniff toolkit should have had something like this (they already have urlsnarf, filesnarf, etc) to be used for penetration testing.

The only thing aimsnarf requires is Ruby and the ruby-pcap library (which is waaay easier to install than the 10+ CPAN modules that aimsniff requires). After installing the pcap library, simply run aimsnarf.rb on the console, here’s the usage:

Use '-h' to display usage
Usage: aimsnarf.rb [ -dnv ] [ -i interface | -r file ] [ -c count ] [ -s snaplen ] [ filter ]
Options:
-n do not convert address to name
-d debug mode
-v verbose mode

Due to the way that ruby-pcap works, I don’t have control over the usage displayed, currently the only real options you should mess with are ‘-i interface‘ and ‘-r file‘, changing anything else might produce “unknown” consequences ;). If you want to see hex dumps of the AIM data, edit the script and change the line “ap.data_debug(0)” to be “ap.data_debug(1)“, this will display the hex data as it is received.

Ignore the “pcap.bundle: warning: do not use Fixnums as Symbols” warnings you get when you run the program, the warning lies with the ruby-pcap library, so it’s out of my hands to fix. When run correctly, you should see something like this:

****** --> <you>: <HTML>what're you up to?</HTML>
<you> --> ******: <HTML>doing some stuff</HTML>
****** --> <you>: <HTML>awesome</HTML>
<you> --> ******: <HTML>talkity talk talk</HTML>
etc, etc

“******” will be the screen name of the person that’s talking. Yes, AIM sends the HTML tags, I don’t put those on.

Tangent:
Let’s talk a little bit about how much I hate the AIM protocol :D :D
Take a look at the protocol listing as given from ethereal, you can see that each AIM packet actually holds a pretty good amount of information, turns out, AOL decided to make a ton of their fields variable length, which means a headache for me in decoding it, because the length has to be read, translated, then used to set the offset for reading the data, this is the reason the code for the script is incredibly messy, I plan on cleaning it up at a later time. In a future post, I’ll also go into more detail about how this particular script decodes the protocol (very much hackish at the moment).

Known Issues:

  • Messages received by people who are away don’t get intercepted due to the packet being different than a regular incoming message packet
  • Different clients might not work (depending on the features supported). Right now I’ve tested with GAIM/Pidgin and Adium, it looks like Trillian isn’t working correctly yet, although I’ve collected some data for analysis so I can get it working.
  • This is probably the first *useful* script I’ve written in Ruby. I am not a ruby master so the code is really messy and probably badly written, have a problem with it? Send a patch!
  • OTR encrypted chat interception doesn’t work (duh)

TODO (no particular order):

  • Clean up code to make it easier to extend to different protocol/clients
  • Fix the Trillian problem
  • Test with AOL’s AIM client
  • Fix the incoming/away message
  • Correctly detect OTR chat and do (something?) about it

Remember people, don’t send credit card numbers, social security numbers, passwords, PIN numbers, etc over IM, ESPECIALLY when you’re somewhere like a coffeeshop using public wifi.

Thanks to the HeX LiveCD team for putting out a great release, already having the tools installed for use in a system is super helpful :)

Questions? Problems? Patches? Hatemail? Email me or leave a comment below!

]]> http://writequit.org/blog/2007/11/12/introducing-aimsnarfrb-a-simple-aim-sniffing-tool-written-in-ruby/feed/ 9 An update on the Sun Blade 150 http://writequit.org/blog/2007/10/15/an-update-on-the-sun-blade-150/ http://writequit.org/blog/2007/10/15/an-update-on-the-sun-blade-150/#comments Mon, 15 Oct 2007 20:42:48 +0000 http://writequit.org/blog/?p=77 Well, I finally got around to finishing doing all the installs and setup on the Blade 150 I had laying around. In the end, since it only had 1gb of RAM and only 1 600 Mhz UltraSPARC II processor, I decided to go with FreeBSD instead of Solaris.

Initially, Solaris worked great serving up a webpage, however, the fact that I did a whole install and the fact that solaris is not exactly speedy on older hardware made working with it a little painful. If unattended, the next time I accessed the machine it would take a few seconds to spin up before allowing a login or serving a webpage. The fact that I left mostly all of the daemons running didn’t help. Yea, I know I could have disabled them all, I just like started clean rather than having to clean up.

Enter FreeBSD. I decided to stay away from Linux also, short of a Gentoo install (which would be painfully slow to compile everything), it’s an extremely easy way to get a minimal install with the smallest amount of effort. That and I enjoy using different things, time to brush up on the BSD knowledge since it’s been a couple of years since I’ve used it. Anyhow, now the machine is running FreeBSD 6.2-RELEASE with a pretty vanilla install. I set up Lighttpd, MySQL, PHP for a web service so I can teach Delilah PHP one of these days. I also set up ajaxterm so I can access a command-line from places where SSH is blocked completely *cough*work*cough* in the event of an emergency.

Overall, I’m liking it more than Solaris, it’s certainly a lot more snappy and much easier to get all the things I want using ports than trying to mess with doing a build from source on Solaris.

You can check out my extremely weaksauce main page here:

http://navi.eight7.org

Anyone have any suggestions for what else I should use it for? Let me know in the comments!

]]> http://writequit.org/blog/2007/10/15/an-update-on-the-sun-blade-150/feed/ 1