Zotac ZBox CI549/MI549 nano for Croissants

Croissants is Intrusion Detection and Prevention System (IDPS) which requires 3 network interfaces and CPU with AVX2, Zotac ZBox CI549 or MI549 is another good choice for home and/or SOHO users. It's small footprint and Intel Core i5-7300U (Dual Core/4 Hyperthreading) is suitable for home and/or SOHO users for IDPS, like Croissants.

It comes with 2 network interfaces and one Thunderbolt 3 Type-C port which can connect to an adaptor to become another network interface. It also can install up to 32GB DDR4 memory. In my opinion, it can handle up to 1000Mbps bandwidth with low to medium traffic flow even I did not test it at my side at the moment. However, I will purchase one for the test when it is available.

On the other hand, you can install pfsense with suricata plugin on it when Hyperscan is available for FreeBSD or pfsense. pfsense requires 2 network interfaces only.

Finally, the difference between CI549 and MI549 is that CI549 is passive cooling while MI549 is active.

That's all! See you.

Reference

Zotac ZBox Comparison 2017

One More Secure Layer For Your Security Stack

Quad9 is founded by IBM, PCH and Global Cyber Alliance to provide a free DNS service to you that can block malicious websites when you are surfing the internet.

You can set it up on your router or personal computer in a few steps. It is painless to set it up as the official site provides videos and text documentation to help you to set it up.

Make sure you put "9.9.9.9" on the toppest position of your DNS list in your router or personal computer.



I have tested it and find out that the surfing speed is very fast without lagging. Finally, be keep in mind that Quad9 cannot 100% protect you from being reached all the malicious websites. However, it adds one more secure layer on your existing security stack.

That's all! See you.

VPN and IPS For Public Wifi

Many friends of mine always asking me how to protect themselves from being hacked. The most asked question is how to protect them from being hacked when using public wifi. They are asking if VPN can do it or not as they saw a lot of advertisement about it.

I recommend them to use their own VPN server with additional protestion, such as Intrusion Detection and Prevention System (IDPS), Next-Generation Firewall or Unified Thread Management System (UTM). It is because most of those products equipped with Anti-Virus/Malware, Exploit prevention and etc. It would be more better and more secure than just use commercial VPN alone.

Open source solutions will be very great for home users and small businesses. I recommend pfsense with suricata and Croissants. pfsense basically is a router and it can install suricata plugin that making it to be an inline IPS. pfsense also have build-in VPN. On the other hand, Croissants is designed for inline IPS and it does not comes with VPN. You need to setup your own.

Once the VPN and IPS are setup, when you are going to use the public wifi, you can connect to the public wifi hotspot and then connect to your VPN which is setup at your home or office. The traffic will be go through the inline IPS via VPN. As a result, you will be under the protection of the IPS. However, the downside is the battery of your mobile device (such as smartphone) will be drained out more quickly. Therefore, you can connect to your VPN when necessary.

Finally, when using pfsense with suricata, you need to fine tune the rules set in order to prevent some false positive alerts. However, Croissants is already tune for daily usage.

Reference

pfsense Official site
Youtube - Build a Router 2016 Q4 -- pfSense Build
pfsense Forum - Suricata true inline IPS mode coming with pfSense 2.3 -- here is a preview
Youtube - pfSense: Network Intrusion Detection w/Suricata (pt4)
Youtube - Suricata Network IDS/IPS System Installation, Setup and How To Tune The Rules & Alerts on pfSense
Croissants - Intrusion Detection and Prevention System


That's all! See you.

WAIDPS - Wireless Auditing, Intrusion Detection and Prevention System

WAIDPS - Wireless Auditing, Intrusion Detection and Prevention System is an open source project which is designed for both offensive and defensive purpose in mind.

This project is original created by SY Chua of SYWorks Programming. However, it is no longer maintained by him since 2014. The GitHub version is v1.0 R.6 and it is dated Oct 10, 2014. However, the demo in his tutorials and Youtube videos are displayed v1.0 R.7 dated Oct 11, 2014.

This software is a very good design in screen layout and good operation experience. Since v1.0 R.6 will crash when handshake is captured and it is not working properly on Kali Linux 2017.2, I modified the Python script to make it to work again in two days. Meanwhile, IEEE 802.11ac is also supported in my modification.

It is well tested on Kali Linux 2017.2. Other penetration testing Linux distributions may work too.

My modification is also an open source project and it is released under GPLv3.





Reference

[1] This project is forked from https://github.com/SYWorks/waidps
[2] Official tutorial - Part 1
[3] Official tutorial - Part 2
[4] Official tutorial - Part 3
[5] Official Youtube Playlist
[6] RealTek 8812AU Driver Installation
[7] TP-Link Archer T4UHP (Realtek 8812AU chipset)

That's all! See you.

HOWTO : Install RealTek 8812AU Driver with Packet Injection And Monitor Mode Support

TP-Link Archer T4UHP v1 is also supported by this driver with monitor mode and packet injection. It is a IEEE 802.11ac USB dongle.

Although Kali Linux has its own 8812au driver, I find AirCrack-ng's driver is the best.

Step 1 :

On Ubuntu Desktop 16.04.3 :

sudo apt update
sudo apt install build-essential dkms git

On Kali Linux 2017.2 :

apt update
apt install dkms

Step 2 :

git clone https://github.com/aircrack-ng/rtl8812au
cd rtl8812au

Step 3 :

On Ubuntu Desktop 16.04.3 :

Make sure to change at dkms.conf before running the following commands.

nano dkms.conf

Change all "/updates" to "/kernel/drivers/net/wireless" when using Ubuntu.

sudo bash ./dkms-install.sh

On Kali Linux 2017.2 :

bash ./dkms-install.sh

Step 4 :

To remove the dkms driver :

cd rtl8812au

Ubuntu Desktop 16.04.3 :

sudo bash ./dkms-remove.sh

Kali Linux 2017.2 :

bash ./dkms-remove.sh

Step 5 :

To control it, I suggest to use iw wireless tool.

Beware that the driver does not work properly on the following commands :

(1) airmon-ng start wlan0
(2) iw dev wlan0 interface add wlmon0 type monitor

Make sure run "airmon-ng check kill" beforehand.

Reference

AirCrack-ng RTL8812AU driver
HOWTO : Install Forked AirCrack-NG on Kali Linux 2017.3

That's all! See you.

HOWTO : Install GCC 7.x on Ubuntu 16.04.3 LTS

Some features require GCC 7.x to compile with, such as AVX-512.

sudo add-apt-repository ppa:ubuntu-toolchain-r/test
sudo apt update
sudo apt install gcc-7

Set gcc-7 as default in order for the compilation.

sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-7 60 --slave /usr/bin/gcc-ar gcc-ar /usr/bin/gcc-ar-7 --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-7 --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-7

sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-5 60 --slave /usr/bin/gcc-ar gcc-ar /usr/bin/gcc-ar-5 --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-5 --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-5

Now, gcc-7 is the default compiler. To change back to gcc-5, you need to run :

sudo update-alternatives --config gcc

Then select gcc-5.

That's all! See you.

Vulnerability scanner can be trusted?

Many companies use vulnerability scanners to scan their systems, websites, products often to make sure they are secured. However, the former CEO of being hacked Equifax blamed that the system had been scanned after a week when the Apache Struts vulnerability had been announced. The scanner cannot detect the presence of un-patched Apache Struts implementations.

Please see the 8th paragraph of this articie for the captioned mention statement.

May be the vulnerability scanner signatures are not up-to-date that caused this fault. So, your vulnerability scanner should be up-to-date too!

That's all! See you.

Cloudflare-Recon Version 0.2 Demo

Cloudflare-Recon is forked from Cloudflare-enum which is written in Python. It obtains the DNS zone record from a website that protected by CloudFlare. This tool is a Swiss Army Knife that can be defensive and/or offensive.

CloudFlare is a cloud based service that provides Distributed Denial of Service (DDos) or DoS as well as Web Application Firewall (WAF) protection to the websites. The real IP address of the websites that protected by Cloudflare will be hidden as purpose. However, Cloudflare is a well known company that aiding and abetting criminals who host their websites behind it for malicious activities.

When the DNS zone records are configured incorrectly, the IP address of the server cannot be hidden and Cloudflare cannot protect you from being DDoS/DoS.

This tool is useful for law enforcements, hackers and sysadmins for finding out the real IP of the website that protected by Cloudflare.

Cloudflare-Recon is modified by Samiux.

Changlog :
Version: 0.1 - Sept 10, 2017 GMT+8
[+] Forked from Cloudflare-enum
[+] Enhancement

Version: 0.2 - Sept 12, 2017 GMT+8
[+] Improve readable foramtted output
[+] Error handling





That's all! See you.

Cloudflare-Recon version 0.1 Demo

Cloudflare-Recon is forked from Cloudflare-enum which is written in Python. It obtains the DNS zone record from a website that protected by CloudFlare. This tool is a Swiss Army Knife that can be defensive and/or offensive.

CloudFlare is a cloud based service that provides Distributed Denial of Service (DDos) or DoS as well as Web Application Firewall (WAF) protection. The real IP address of the websites that protected by Cloudflare will be hidden as purpose. However, Cloudflare is a well known company that aiding and abetting criminals who host their websites behind it for malicious activities.

When the DNS zone records are configured incorrectly, the IP address of the server cannot be hidden and Cloudflare cannot protect you from being DDoS/DoS.

This tool is useful for law enforcements, hackers and sysadmins for finding out the real IP of the website that protected by Cloudflare.

Cloudflare-Recon is modified by Samiux on Sept 10, 2017.

Version: 0.1 - Sept 10, 2017 GMT+8
[+] Enhancement











That's all! See you.

HatCloud-ng version 0.1 Demo

HatCloud-ng is forked from HatCloud which is written in Ruby. It obtains the "Real IP Address" from a website that protected by CloudFlare. This tool is a Swiss Army Knife that can be defensive and/or offensive.

CloudFlare is a cloud based service that provides Distributed Denial of Service (DDos) or DoS as well as Web Application Firewall (WAF) protection. The real IP address of the websites that protected by Cloudflare will be hidden as purpose. However, Cloudflare is a well known company that aiding and abetting criminals who host their websites behind it for malicious activities.

When the DNS zone records are configured incorrectly, the IP address of the server cannot be hidden and Cloudflare cannot protect you from being DDoS/DoS.

This tool is useful for law enforcements, hackers and sysadmins for finding out the real IP of the website that protected by Cloudflare.

HatCloud-ng is modified by Samiux on Sept 10, 2017.

Version: 0.1 - Sept 10, 2017 GMT+8
[+] Bug fixes for original HatCloud dated 2017-09-10
[+] Information and error handling enhancement





That's all! See you.

HOWTO : Install Metasploit Framework on Ubuntu 16.04.3 LTS

Metasploit Framework is a exploit framework.

Step 1 :

sudo apt install curl

cd ~
mkdir infosec
cd ~/infosec
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall

msfconsole

Answer "yes" when you see this prompt message :

Would you like to use and setup a new database (recommended)? yes

Update and Upgrade

sudo apt update
sudo apt dist-upgrade

That's all! See you.

HOWTO : Install John on Ubuntu 16.04.3 LTS

John is a password cracker.

Step 1 :

sudo apt install git build-essential libssl-dev

Step 2 :

cd ~
mkdir infosec
cd infosec

git clone https://github.com/magnumripper/JohnTheRipper.git
cd JohnTheRipper/src
./configure
make clean
make

cd ../run
./john --help

Update and Upgrade

sudo apt update
sudo apt dist-upgrade

cd ~/infosec/JohnTheRipper
git pull origin master
cd src
./configure
make clean
make

That's all! See you.

HOWTO : Install THC-Hydra on Ubuntu 16.04.3 LTS

THC-Hydra is a password brute forcer.

Step 1 :

sudo apt install git build-essential libssl-dev libssh-dev libidn11-dev libpcre3-dev libgtk2.0-dev libmysqlclient-dev libpq-dev libsvn-dev firebird-dev libncurses5-dev

Step 2 :

cd ~
mkdir infosec
cd infosec
git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra
./configure
make
./hydra -h
./xhydra

Update and Upgrade

sudo apt update
sudo apt dist-upgrade

cd ~/infosec/thc-hydra
git pull origin master
make clean
./configure
make

That's all! See you.

HOWTO : Install Recon-ng on Ubuntu 16.04.3 LTS

Recon-ng is a full-featured Web Reconnaissance framework.

Step 1 :

sudo apt install git python-pip python-dnspython python-mechanize python-slowaes python-xlsxwriter python-jsonrpclib python-lxml

Step 2 :

pip install dicttoxml --upgrade

Step 3 :

cd ~
mkdir infosec
cd ~/infosec
git clone https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git
cd recon-ng
./recon-ng

Update and Upgrade

sudo apt update
sudo apt dist-upgrade

pip install dicttoxml --upgrade

cd ~/infosec/recon-ng
git pull origin master

That's all! See you.

HOWTO : Install Weevely3 on Ubuntu 16.04.3 LTS

Weevely3 is a web shell and it is hardly detected by Anti-Virus and the traffic is obfuscated within the HTTP requests.

Step 1 :

sudo apt install g++ python-pip libyaml-dev python-dev libncurses5 libncurses5-dev

mkdir infosec
git clone https://github.com/epinna/weevely3.git
cd weevely3
pip install -r requirements.txt --upgrade

Step 2 :

cd ~/infosec/weevely3
python weevely3.py -h

Update and Upgrade

sudo apt update
sudo apt dist-upgrade
cd ~/infosec/weevely3
git pull origin master
pip install -r requirements.txt --upgrade

Reference

Documentation

That's all! See you.

HOWTO : Install Vega 1.0 on Ubuntu 16.04.3 LTS

Vega is an open source web application vulnerability scanner.

Step 1 :

sudo apt install libwebkitgtk-1.0 default-jdk unzip

mkdir infosec
cd ~/infosec

wget https://dist.subgraph.com/downloads/VegaBuild-linux.gtk.x86_64.zip
unzip VegaBuild-linux.gtk.x86_64.zip

Step 2 :

cd vega
./Vega

That's all! See you.

HOWTO : Install SpiderFoot on Ubuntu 16.04.3 LTS

SpiderFoot is an open source intelligence automation tool.

Step 1 :

sudo apt install git python-lxml python-netaddr python-m2crypto python-cherrypy3 python-mako python-requests python-bs4

Step 2 :

cd ~/
mkdir infosec
cd ~/infosec
git clone https://github.com/smicallef/spiderfoot.git

Step 3 : (Optional)

If you want to implement login feature, you need to :

echo "admin:admin" > ~/infosec/spiderfoot/passwd

Step 4 :

To run it :

cd ~/infosec/spiderfoot
python ./sf.py

Step 5 :

Open your browser and point to http://127.0.0.1:5001

* Make sure to add API Keys to the related items in the settings.

Update and Upgrade

sudo apt update
sudo apt dist-upgrade
cd ~/infosec/spiderfoot
git pull origin master

Reference

Documentation

That's all! See you.

HOWTO : Install OpenVAS 9 on Ubuntu 16.04.3 LTS

OpenVAS is an open source vulnerability scanner.

Step 1 :

sudo add-apt-repository ppa:mrazavi/openvas
sudo apt update

sudo apt install sqlite3
sudo apt install openvas9

* Make sure you install sqlite3 first, otherwise, the openvas9 will fail to install.

Step 2 :

To enable pdf reports:

sudo apt install texlive-latex-extra --no-install-recommends
sudo apt install texlive-fonts-recommended

To install openvas-nasl utility:

sudo apt-get install libopenvas9-dev

Step 3 :

sudo greenbone-nvt-sync
sudo greenbone-scapdata-sync
sudo greenbone-certdata-sync

Step 4 :

sudo systemctl restart openvas-scanner
sudo systemctl restart openvas-manager
sudo openvasmd --migrate (#only required when upgrading from an older version)
sudo openvasmd --rebuild --progress

Step 5 :

Default URL is https://localhost:4000
Use "admin" as username and password.

Step 6 : (Optional)

If you want to change port number, you need to :

sudo nano /etc/default/openvas-gsa
sudo systemctl restart openvas-gsa

That's all! See you.

HOWTO : Install SQLMap on Ubuntu 16.04.3 LTS

Metasploit Framework is required for SQLMap takeover process. The following is the complete SQLMap installation procedure on Ubuntu 16.04.3 LTS.

Step 1 :

sudo apt update
sudo apt dist-upgrade
sudo apt install git python-pip curl

Step 2 : Install SQLMap

cd ~/
mkdir infosec
cd ~/infosec

git clone https://github.com/sqlmapproject/sqlmap.git

Step 3 : Install Metasploit Framework

cd ~/infosec
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall

msfconsole

Answer "yes" when you see this prompt message :

Would you like to use and setup a new database (recommended)? yes

Step 4 : Install SQLMap Dependencies

sudo apt install python-impacket python-ibm-db-sa python-kinterbasdb python-pyodbc python-pymssql python-pymysql python-psycopg2 python-pysqlite2 python-pymssql python-ntlm

pip install cx_Oracle --upgrade

Step 5 : Update/Upgrade

sudo apt update
sudo apt dist-upgrade

msfupdate

pip install cx_Oracle --upgrade

cd ~/infosec/sqlmap
python sqlmap.py --update

That's all! See you.

時事觀察節目-談雙學三犯只是加刑

余非：2017年8月21日，上訴庭宣判「雙學三犯」黃之鋒、羅冠聰和周永康三人加刑前，李卓人竟然在面書﹝Facebook﹞預先上載美國國會及行政當局中國委員會支持黃之鋒等人但未公布的聲明。聲明指，美國國會打算在黃之鋒等人被判入獄後，重新檢視香港在美國法例所賦予的特殊關係，明顯公然干涉香港內部事務。

余非又指，「犯罪動機高尚」，這些「搞事青年骨幹」就可以免責？「雙學三犯」黃之鋒、羅冠聰和周永康判監，余非強調是法庭對他們只是加刑，並不是重﹝重新﹞判。

請分享出去一齊聽聽余非的精闢分析！

「廣東話」原聲：余非三藩市《星島電台》時事觀察節目




余非 個人簡介：

香港中文大學中文系畢業，副修中國音樂(古箏)，於同校取得碩士學位。之後赴英國修讀出版碩士。在港長期擔任編輯工作，曾主編高錕唯一一本中文自傳《潮平岸闊──高錕自述》；業餘從事文藝寫作。2003年轉為全職作家。

引述：
余非三藩市《星島電台》談雙學三犯只是加刑