Gitrob on the Network
Developers generally like to share their code, and many of them do so by open
sourcing it on GitHub, a social code hosting and collaboration service. Many
companies also use GitHub as a convenient place to host both private and
public code repositories by creating GitHub organizations where employees can
be joined. Sometimes Employee might publish things that might be sensitive
in nature and these things might lead to compromise of a system.
Gitrob is a tool that Michael Henriksen developed that scans the github
repositories and match filenames against a range of patterns for files that
typically contain sensitive or dangerous information.
The first thing the tool does is to collect all public repositories of the
organization itself. It then goes on to collect all the organization members
and their public repositories, in order to compile a lis... (more)
The Metasploit Framework is a penetration testing toolkit, exploit
development platform, and research tool. The framework includes hundreds of
working remote exploits for a variety of platforms. Payloads, encoders, and
nop slide generators can be mixed and matched with exploit modules to solve
almost any exploit-related task. A very nice feature in Metasploit is the
ability to pivot through a Meterpreter session to the network on the other
side. This tutorial walks you through how this is done once you have a
Meterpreter session on a foreign box. We begin right after a client sid... (more)
To capture, parse, and analyze traffic tcpdump is a very powerful tool. To
begin a basic capture uses the following syntax.
tcpdump -n –i -s
-n tells tcpdump to not resolve IP addresses to domain names and
port numbers to service names.
-I tells tcpdump which interface to use.
-s tells tcpdump how much of the packet to record. I used
1515 but 1514 is sufficient for most cases. If you don’t specify a size
then it will only capture the first 68 bytes of each packet. A snaplen value
of 0 which will use the required length to ... (more)
The purpose of this article is to describe some tools and techniques in
performing the planning, scoping, and recon portion of a penetration test. In
covering these tools and techniques the reader will learn how to use them to
find vulnerabilities in their organization and help improve security posture.
Some other names for this first phase of penetration testing are; OSINT (Open
Source Intelligence), Footprinting, Discovery, and Cyberstalking.
During reconnaissance we'll gather information from public sources to learn
about the target and try to find what is importan... (more)
The OpenSSL is based on SSLeay library developed by Eric A. Young and Tim J.
Hudson and licensed under an Apache-style license. OpenSSL has lots of
features but I will cover encoding, checksums, encryption, passwords and pass
Many Linux distributions have OpenSSL as part of the bundled packages and is
most likely located in /usr/bin. To find it on your system type:
$ which openssl
$ openssl version
OpenSSL 1.0.0a 1 Jun 2010
Versions may vary and currently openssl-1.0.0d Feb 8 is the current version.
Most of the examples that are found in this document sh... (more)