Linux Bypasses

#How to read a file without cat or string in Linux?

1. fold [filename]
2. tar c [filename/directory]
3. iconv [filename]
4. shuf [filename]
5. lzop -v -c [filename]
6. more, less, head, tail
7.python, Perl

#Execute files which might be restricted

1. setpriv --nnp [executable]
2. install [../executable] /tmp
2.a run-parts tmp [free of all other binaries]
3. /lib/ld-linux.so [1-2] [FULL PATH of executable]
The binary does not need to "chmod +x", mean you can chmod executable again if needed

#Scan for executable containing functions

1. scanelf
1.a scanelf -s chmod -R / (looks for executable containing chmod from "/" recursively)

My Linux Sandbox Setup

Checklist

• Check internet [dnsmasq issue]
• tmux
• burp
• wireshark
• chrome
• foxy proxy

Image forensics

steganography 

Tools and tips

• strings, file [bash]
• cat[only works for embedded txt files]
• exiftool
• stegsolve [here]
• zsteg [here]
• gimp [Color> Set color maps>palette]
• unzip [use 7za if it fails]
• binwalk (files in image, not zip) [binwalk]
• Any hex editor [check google for mandatory image field, optional fields may have flags ]
  ubuntu - wxhexeditor, bless
  windows -Hxd hex editor
• Look at headers(chunks,pixels,optional headers,end of file IEND)
• Change width,height bytes [output visible in windows only]
• PNG Filter type extraction: https://github.com/f1nsternacht/libpng
  
  References :
  https://www.youtube.com/watch?v=KUZVIBXfoeA
  http://www.libpng.org/pub/png/spec/1.2/PNG-Contents.html
  https://www.guillermito2.net/stegano/

CTF

CTFs

https://tjctf.org
https://ctf.hacker101.com/ctf

Red Team

Blue Team

https://tjctf.org

Splunk Lookup quirks

Some of the splunk lookup related quirks are:

1. filename must be .csv
2. cloumn_name for lookup must be = a field name in splunk. Should be exactly the same.

Example 1

index="whatever" sourcetype="dns"
   NOT [| inputlookup whitelist.csv
    | fields query ]

*whitelist.csv must have the column name as query.

Example 2
Lookup in secondary search

index="whatever" sourcetype="dns"
| eval DomainName={Logic........}
| search   NOT [| inputlookup whitelistdomain.csv
    | fields DomainName ]

| stats dc(Host) AS HostsPerDomain BY DomainName

*whitelistdomain.csv must have the column name as DomainName.