Brute Force Word List

Directories :
darkc0de

splunk

• Username from linux secure:
  for(?:\suser)?(?:\sinvalid user)?\s(?<user>\S+)
• NOT vs !=
  if the field does not exist in a row. then row will not be included for "!=", however NOT search will include rows which do not have that field.
  

Line of Inquiry

Data Exposure

• Exposure
  What was exposed?
  What caused the exposure? Application? DB?
  How was exposure discovered?
  Duration of exposure with time stamps?
  What is the application for? What data does the application possess or was exposed?
  Get exposed data?
• Abuse
  Who accessed the data during exposure?
  What was accessed during exposure?
  Validate the data is deleted by unauthorized users. 
• Lights On
  Is the application or misconfiguration causing the exposure has been stopped?
  Is the application fixed and back up?
  Service down time?
• Controls
  What access controls were in place?
  What kind of logging was in place?
  What monitoring was in place?
  What security endpoints were in place?
• Hygiene
  What assets are in scope?
  What does the dat flow look like? Design documents
  What are the ingress/Egress point?
• Compliance - Legal
  Is data related to PCI? PII?Financial?Strategical?
  Vendor involvement?
  Legal requirement?
  Communications?  
• Remediations
  What are the new security controls?
  Are the security controls reviewed or tested?
  
  Additional questions should be expected as information is reviewed.

Interesting Event codes

Some Interesting IR eventCodes are:

Login: 4624
Service install : 4697 ,7045
Service Start Type changed: 7040
New Process created: 4688

Cyber Security Frameworks

Here is the list of some of the very helpful Cybersecurity frameworks for aligning security endeavors in the organization

• Attack Matrix for Enterprise
  URL: https://attack.mitre.org/
  Purpose: Break up attack sequence in parts and list tools and relevant details for each. Identify Attack milestones, help identify gaps and align defense strategy
  Tags: BlueTeam,  Strategy
• Attack Eval for Enterprise
  URL: https://attackevals.mitre.org/
  Purpose: Evaluate how tools fit in overall defense strategy. Product Evaluations
  Tags: BlueTeam, Product evaluations
• Effectiveness ScoreCard - Cyber Kill Chain, Lockheed Martin
  URL: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
  https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493920778.pdf
   
  
  Purpose: Measure control effectiveness, where and how the controls fit in. Identify control gaps
  Tags: BlueTeam, Analyst, Strategy
  
• PCI Forensics Investigation report Template
  URL: https://www.pcisecuritystandards.org/documents/Final_PFI_Report_v2.1.pdf?agreement=true&time=1552226789177
  Tags: Reporting Template 

More WireShark

This is going to be a more of working notes style of post for various filters I use in WireSkark for different use cases and references to awesome material.

• Potential Flash Malware download:
  http.content_type == "application/x-shockwave-flash"
• Potential executable download:
  frame contains "DOS mode"
• Find hostname frames:
  nbns.nb_flags.group == 0
• Http Methods:
  http.request.method == "POST"
• Http Redirects
  http.response.code gt 300 && http.response.code lt 400
• Find Usernames in Kerberos tickets:
  kerberos.cname_string == 1
• IRC traffic
  tcp.port == 6666 || tcp.port == 6667 || tcp.port == 6668 || tcp.port == 6669
• DNS query: dns.qry.name
• Multiple Dns Answers : dns.count.answers gt 5
  
• Custom Fields:
• http.header.True-Client-IP
• http.header.WL-Proxy-Client-IP
• kerberos.CNameString

Pcap analysis - packettotal, security onion

References:

https://www.wiresharkbook.com/studyguide.html

https://www.wiresharkbook.com/troubleshooting.html

WireShark Malware Analysis basics

I was going through some of the pcap challenges on https://www.malware-traffic-analysis.net. There I stumbled upon a some very good posts for getting stared with wireshark which are mentioned in the reference below.

HTTP

Some columns can be set in wireshark which help in http traffic investigations:

• Src Port

• Dest Port 

• Host 

• User-Agent 

• Request URI 

• Content-Type 

• Status Code
• Location (302) [Heplful when SSL com starts]
• Referer

Tshark:

 tshark -r “/file.pcap"  -T fields -e dns.qry.name -e ip.src -e ip.dst  -e _ws.col.Info | grep “mydomain\|10.10.10.15\|10.10.10.16"
 





Reference:

• Changing the column display in Wireshark

• Adding HTTPS server names to the column display in Wireshark

• Identifying a host on the network

• Examining Tor traffic

SetUp CGI perl on CentOS apache

Setup apache webserver on CentOS

sudo yum install httpd

To make this web server available from lan or we need to whitelist our interfaces as Listen *:80

in /etc/httpd/conf/httpd.conf 

Now, we setup CGI execution, change the directory settings in httpd.conf

Before restarting httpd we have to change one more thing inside /etc/httpd/conf/httpd.conf:

<Directory "var/www/html">
    Options +ExecCGI
    AddHandler cgi-script .cgi .pl
</Directory>

Change permissions to allow for CGI to execute

And this one got me stuck a lot! Don't overlook this!

You need to tell your server that these CGI scripts are allowed to be executed as programs.

chmod 705 *.cgi

Or you can target individual CGI scripts.

chmod 705 hello.cgi

Put cgi files in /var/www/cgi-bin/ and run as  http://serverip/cgi-bin/script.cgi

cat /etc/httpd/conf/httpd.conf | grep ScriptAlias should have something like this in the output

ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

This is enough to run a test cgi script.

In case aces you might need to install more packages for a particular script such as MD5 digest.

# sudo yum install perl-Digest-MD5 -y

Now Reboot Apache : sudo apachectl stop, sudo apachectl start

Blind Sqli, Data retrieval from logs

Search string

Find files with particular string in file name

• find / -name "*.err"
  / - starting from / to all sub directories.
• Specify file type with find type = d (directory) , f (file)
• Find SUID files
  find / -perm /u=s
• To find all the files which are modified more than 50 days back and less than 100 days.
  # find / -mtime +50 –mtime -100
•  To find all the files which are changed in last 1 hour.
  # find / -cmin -60
• To find all the files which are modified in last 1 hour.
  # find / -mmin -60
• To find all the files which are accessed in last 1 hour.# find / -amin -60

Find String inside files and print file name

• grep -rnw '/path/to/somewhere/' -e 'pattern'
  /path/to/somewhere/ - Starting directory
  -r or -R is recursive,
  -n is line number, and
  -w stands for match the whole word.
  -l (lower-case L) can be added to just give the file name of matching files.
   
• ack 'text-to-find-here'

 
Redirect errors to Stdout

• 2&>1
• Now you can grep out the errors
  find / -name "*.err" 2&>1 | grep -v denied