sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
Install
sudo apt-get install git
cd ~
mkdir arsenal
cd arsenal
git clone https://github.com/sqlmapproject/sqlmap.git
cd sqlmap
python sqlmap.py -hh
Number one of the biggest security holes are passwords, as every password security study shows.
THC-Hydra is a proof of concept code, to give researchers and security
consultants the possiblity to show how easy it would be to gain unauthorized access from remote to a system.
cd ~
mkdir arsenal
cd arsenal
git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra
./configure
make
./hydra -h
./xhydra
* Oracle, NCP and SAP/R3 are not supported in this build as there are no libraries available from the repos
* you can install by sudo apt-get install hydra hydra-gtk
Update/Upgrade
sudo apt-get update
sudo apt-get dist-upgrade
cd ~/arsenal/thc-hydra
git pull origin master
make clean
./configure
make
Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
Install
sudo apt-get install git build-essential
cd ~
mkdir arsenal
git clone https://github.com/nmap/nmap.git
cd nmap
./configure
make
sudo make install
sudo nmap -sS -sV 192.168.0.100
* or you can install by sudo apt-get install nmap
Update/Upgrade
sudo apt-get update
sudo apt-get dist-upgrade
cd ~/arsenal/nmap
git pull origin master
make clean
make
sudo make install
Masscan is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second.
It produces results similar to nmap, the most famous port scanner. Internally, it operates more like scanrand, unicornscan, and ZMap, using asynchronous transmission. The major difference is that it's faster than these other scanners. In addition, it's more flexible, allowing arbitrary address ranges and port ranges.
NOTE: masscan uses a custom TCP/IP stack. Anything other than simple port scans will cause conflict with the local TCP/IP stack. This means you need to either use the -S option to use a separate IP address, or configure your operating system to firewall the ports that masscan uses.
Install
To install Masscan on Ubuntu 14.04.03 LTS Desktop :
SpiderFoot is an open source intelligence automation tool. Its goal is to automate the process of gathering intelligence about a given target, which may be an IP address, domain name, hostname or network subnet.
SpiderFoot can be used offensively, i.e. as part of a black-box penetration test to gather information about the target or defensively to identify what information your organisation is freely providing for attackers to use against you.
Install
To install Spiderfoot on Ubuntu 14.04.3 LTS Desktop :
Recon-ng is a full-featured Web Reconnaissance framework written in Python. Complete with independent modules, database interaction, built in convenience functions, interactive help, and command completion, Recon-ng provides a powerful environment in which open source web-based reconnaissance can be conducted quickly and thoroughly.
Recon-ng has a look and feel similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. However, it is quite different. Recon-ng is not intended to compete with existing frameworks, as it is designed exclusively for web-based open source reconnaissance. If you want to exploit, use the Metasploit Framework. If you want to social engineer, use the Social-Engineer Toolkit. If you want to conduct reconnaissance, use Recon-ng!
Install
To install Recon-ng on Ubuntu 14.04.3 LTS Desktop :
*** Please note that all the tests are testing on Linux host (Ubuntu 14.04.3), Windows host may have some different results. ***
*** Updated on August 14, 2015 : VirtualBox 5.0.2 for Linux fixed the slow speed (VMM: fixed an issue causing artifically high load averages on Linux hosts). ***
Kali Linux 2.0 is released on today (August 11, 2014 EST). I downloaded 64-bit full version and installed it on VirtualBox 5.0. The host computer has Intel Celeron(R) CPU N2930 @ 1.83GHz × 4 and 8 GB RAM. I assigned 5 GB RAM to Kali Linux 2.0. It is quite slow for it to run with 5GB RAM on my VirtualBox 5.0. Meanwhile, the sound always mute on every start up even you have set it before.
(A) Installation
When installing via non-graphic interface, you may encounter no network mirror repos, you need to bypass it by selecting "Continue without a network mirror? Yes" and we will edit the /etc/apt/sources.list later. Graphic interface may also has the same problem too.
After the installation is completed, we can edit the /etc/apt/sources.list if you encountered no mirror repos when install.
nano /etc/apt/sources.list
The content of the file should be looking like this :
deb http://http.kali.org/kali sana main non-free contrib
deb-src http://http.kali.org/kali sana main non-free contrib
deb http://security.kali.org/kali-security/ sana/updates main contrib non-free
deb-src http://security.kali.org/kali-security/ sana/updates main contrib non-free
(B) Install VirtualBox 5.0 Guest Additions CD
When you are going to install VirtualBox 5.0 Guest Additions CD, you need to install dkms first :
apt-get install dkms
* It will also install related headers files. If not, you need to install the headers files yourself.
When install VirtualBox Guest Additions CD, you may encounter the following error :
*** Error in `systemctl': double free or corruption (fasttop): 0x00007fc0cb648ae0 ***
It should be systemctl error. I do not know what it will be affected so far. After checking the dmesg message, the error is due to :
systemd[1]: Cannot add dependency job for unit vboxadd-service.service, ignoring: Unit vboxadd-service.service failed to load: No such file or directory.
It is recommended to uninstall the Guest Additions CD at the moment and some features will be not available on the guest virtual machine.
(C) Uninstall VirtualBox 5.0 Guest Additions CD
To uninstall VirtualBox Guest Additions, run :
/opt/VBoxGuestAdditions-5.0.0/uninstall.sh
This error will show again :
*** Error in `systemctl': double free or corruption (fasttop): 0x00007f124e3f2ae0 ***
(D) Not working properly applications
The following applications are launched from the Quick Menu on the left hand side of the screen.
armitage - it cannot be launched Maltego - it launches but it cannot be operated and it cannot be quit too BeEF - it shows an error and no login screen is displayed UNLESS you start the "beef start" at "System Services" under "Applications" menu
There may be some more other applications that cannot work, such as "system log", "VLC media player", "ImageMagick" and etc. I cannot test them all one by one as they are too many.
* Even the VirtualBox Guest Additions is uninstalled or reinstall the Kali 2.0, the captioned applications still do not working properly
** Other applications on the Applications menu are not tested as well as those are not in the Applications menu
*** Running BeEF, it produces the following error : (process:1371): GLib-CRITICAL **: g_slice_set_config: assertion 'sys_page_size = 0' failed
(E) Conclusion
Kali Linux 2.0 is not well tested before it is released. It is very disappointed. Kali 2.0 is slower than 1.1.0a on the same testing machine. Or you may need a more powerful computer or laptop to do with it. Some applications cannot be running properly on the Quick Menu in this release. DISAPPOINTED!
That's all! See you.
Update on August 12, 2015
I conducted a random test on Kali Linux 2.0, I found the following :
redis-server is running in the background.
Apache2 is listening on TCP6 only instead of TCP4 and TCP6 at the same time.
OpenVAS cannot be started properly via "Applications", "System services", "openvas start". Systemd error produced.
It seems that systemd is buggy.
Update on August 13, 2015
After talking with the founder of Offensive Security (muts), I going to install Kali Linux 2.0 to other virtual machine software to see the result.
I try to install Kali Linux 2.0 on VMWare Workstation 11 for Linux on a laptop (Lenovo Thinkpad X200 with 4GB RAM) but it failed in the middle and the installation never completed. I do not have Workstation 12, so I cannot test it.
Then, I pick up another laptop (Lenovo Thinkpad X201s with 8GB RAM) which is running VirtualBox 4.3.30 on Ubuntu 14.04. I assigned 4GB RAM to Kali. The installation is smooth. May be the Kali Linux repos server is out of the DDoS. (Kali Linux repos server has been DDoS for hours since it is released according to the founder of Offensive Security).
The VirtualBox Guest Additions CD is installed without problem. However, "armitage", "system log", "VLC media player" and "ImageMagick" do not launched. Meanwhile, "redis-server" is running in the background; "Apache2" is listening on TCP6 only. "systemd" errors will be produced on selecting "openvas start".
On the other hand, "Maltego" and "BeEF" are working properly with only one click.
Kali Linux 2.0 is running fast and responsive on VirtualBox 4.3.30.
Some users at #kali-linux (IRC channel) found some weird problems, such as "thin.services" is running and making the system very slow.
Ubuntu 14.04.4 desktop is running smoothly on VirtualBox 5.0. It is suspected that Kali Linux 2.0 selects hardware and virtual machine software.
The conclusion is changed to ACCEPTABLE! Kali Linux Team should be doing better.
Update on August 13, 2015 (Part 2)
This time, I want to test Kali Linux 2.0 VirtualBox 64-bit image and it is running 2GB RAM and 30GB hard drive.
There is a "kali-proposed-updates.list" at /etc/apt/sources.list.d/ and the content is :
deb http://http.kali.org/kali sana-proposed-updates main contrib non-free
Running on VirtualBox 5.0 on Ubuntu 14.04.3 host :
"armitage" cannot be launched.
"maltego" cannot run properly and it cannot be quit.
"BeEF" launched but no login screen UNLESS run "beef start" at "System services" under "Applications".
"VLC media player" and "ImageMagick" do not work.
"system log" works.
"Apache2" is listening on TCP6 only.
"redis-server" is running in the background.
"dkms" accompanied with only one headers file.
Guest Additions CD install with the same "systemctl" error message.
"systemd" errors will be produced on selecting "openvas start".
Running on VirtualBox 4.3.30 on Ubuntu 14.04.3 host :
"armitage" cannot be launched.
"maltego" and "BeEF" can be launched with one click.
"VLC media player" and "ImageMagick" do not work.
"system log" works.
"Apache2" is listening on TCP6 only.
"redis-server" is running in the background.
"dkms" accompanied with only one headers file.
Guest Additions CD install with the same "systemctl" error message.
* Not kidding, it has error message.
"systemd" errors will be produced on selecting "openvas start".
Obviously, Kali Linux Team did not well test their work before it is released. The content of VirtualBox image is different from the ISO. The rating is still remain as ACCEPTABLE!
I will not test any ISO or image files for this release any more. May be wait for the next release.
* It seems that this VirtualBox image is installed VirtualBox 5.0 Guest Additions CD
Update on August 14, 2015
muts stated that I am misinformed. Therefore, I make a very boring video (about 26 minutes long) to proof which is posted at the beginning of this article today.
Armitage is updated yesterday by Kali Linux Team. Therefore, it is working fine now. Meanwhile, VirtualBox is updated from 5.0.0 to 5.0.2 and the high CPU loading on Linux host is fixed.
I also test Debian 8.1 (latest update) on the same environment and installed the Guest Additions CD. I also encounter the "systemctl double free or corruption (fasttop)" error. This error may be from VirtualBox 5.0.x or from Debian.
However, Kali Linux Team forgot to test their amazing Kali Linux 2.0 with VirtualBox 5.0.x on Linux host. Therefore, the rating is still ACCEPTABLE.
Update on August 17, 2015
Fedora 22 is systemd by default. I install Fedora 22 (64-bit) on VirtualBox 5.0.2 with Ubuntu 14.04 host without any problem or error, including Guest Additions CD install.
I also test Kali Linux 2.0 (64-bit) on VirutalBox 5.0.2 with Mac OSX 10.10.5 and it has the similar errors.
Update on August 25, 2015
Since I do not like Kali Linux 2.0, I install my favourite tools on Ubuntu 14.04 LTS recently (please refers to here). I find out that at least BeEF is running very difference between Kali Linux 2.0 and Ubuntu 14.04 on VirtualBox 5.0.2. Kali Linux 2.0 will produces error messages while Ubuntu does not. Both version of BeEF are 0.4.6.1-alpha. I make a video on that, here you are :
Android devices running Android versions 2.2 through 5.1.1_r5 contain vulnerabilities in the Stagefright media playback engine. Exploitation of these vulnerabilities may allow an attacker to access multimedia files or potentially take control of a vulnerable device.
Detection
To test your Andorid if it is vulnerable to Stagefright vulnerabilities, you can use the following Apps by Zimperium INC.
It is recommended to update/upgrade your Android ROM to non-vulnerable version. If your vendors do not release any update/upgrade, you can perform the following steps for a workaround.
I confirmed that CyanogenMod 12.1 Nightly for OnePlus One is fixed the Stagefright vulnerabilities by using Google Play - Stagefright Detector by Zimperium INC while OnePlus One v5.0.2 (Cyanogen OS version 12.0-YNG1TAS2I3) and Google Nexus 5 v5.1.1 (Build number LMY48B) are still vulnerable to Stagefright vulnerabilities at the time of this writing.
It is also confirmed that CyanogenMod 12.0 and 12.1 are fixed for the vulnerabilities. Or, you may consider to flash CyanogenMod ROM if your devices are supported.
If you have OnePlus One, you can follow this guide to update/upgrade your OnePlus One.
The Node Chat Room (NodeChat) is developed with Node.js and it is forked from "Smashing Node.js: JavaScript Everywhere" Chapter 6. It is modified by Samiux and is released under GPLv3 License.
It provides basic chat room features, including private message. It will not save anything in the server.
Hardware : OnePlus One 64GB (Black) (CyanogenMod 12, Android 5.0.2)
Desktop : Ubuntu Desktop 14.04.2 LTS
Accessories : OTG USB cable and 32GB USB thumb drive
I am running Ubuntu Desktop 14.04.2 LTS. However, the android-tools-adb is out of date to operate with Android 5.1. So, we use OTG USB to copy all the required files to the OnePlus One ("storage" directory) instead of using adb command.
Copy the CyanogenMod ROM, such as cm-12.1-20150729-NIGHTY-bacon.zip, to "storage" directory of OnePlus One.
Flash CyanogenMod ROM :
Reboot to TWRP Recovery. Select "Backup". To backup the OnePlus One stock ROM (CyanogenMod 12).
Select "Wipe". To delete all data EXCEPT "System" and "Internal storage" as your CyanogenMod 12.1 ROM is there. This step must do, otherwise; your flash will be failed due to "incorrect signature".
Select "Install". To select "/0" and then "/storage", select the CyanogenMod 12.1 Nightly image file.
Copy the gapp-5.1-arm-2015-07-17-13-29.zip to "storage" directory of OnePlus One.
Boot to TWRP Recovery and select "Install" to install Google Play.
Now you can configure your OnePlus One with CyanogenMod 12.1 ROM and download the Apps from Google Play.
Optional :
If you want to replace the TWRP Recovery with the CyanogenMod Recovery, you can enable "Cyanogen recovery" at "Developer options". When the next Nightly update is available, you can OTA it and it will replace the TWRP Recovery with CyanogenMod Recovery :
Enable Cyanogen recovery
You can consider to lock your bootloader back too :
sudo fastboot oem lock
*** If you unlock the bootloader, all your data will be destroyed ***
You can also consider to turn off the "Developer options" and disable "Advanced root" as well as "Android debugging".
Remark
CyanogenMod stated that the recent Stagefright vulnerabilities has been fixed in CyanogenMod 12 and 12.1 Nightlies before the time of this writing. Please refer to here.
Since Android ROM may have vulnerabilities, it is better to buy Google Android products as it will provide the most latest fix or update to their devices. Or you can consider to flash responsible 3rd party ROM developers, such as CyanogenMod. However, my Google Nexus 5 (5.1.1) does not have the fix OTA at the time of this writing. So sad.
UPDATE on August 06, 2015
I confirmed that CyanogenMod 12.1 Nightly for OnePlus One is fixed the Stagefright vulnerabilities by using Google Play - Stagefright Detector by Zimperium INC while OnePlus One v5.0.2 (Cyanogen OS version 12.0-YNG1TAS2I3) and Google Nexus 5 v5.1.1 (Build number LMY48B) are still vulnerable to Stagefright vulnerabilities.
This article and accompanied youtube video are showing you that TLS/SSL RC4 is now considered vulnerable. If you are running website that using RC4 cipher, please consider to disable it. If you are using Firefox, you can disable it by using the following command :
At the url address field, enter "about:config" and then search for "rc4". After that, change all the entries from "true" to "false". Please note that there should be 4 entries for RC4.
Recently, Hacking Team (a team of hackers which help governments to monitor and hack their citizens) has been hacked and some (at least 3 at the time of this writing) Flash player 0day expolits by Hacking Team were disclosed. Flash is now considered as vulnerable for all systems as it has no fix at the moment.
Firefox has been disabled the Flash from being played unless you enable it. How to watch Youtube videos? I suggest you to install "Youtube Flash-HTML5" add-on if you are using Firefox. You can enable Flash or HTML5 at anytime.
Croissants is an Intrusion Detection and Prevention System and running with Suricata. The components also including Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager).
Suricata is a high performance Network IDS, IPS and Network Security Monitoring Engine. Croissants running on AF_PACKET with Suricata and it throughtput is up to 10Gbps traffic. AF_PACKET is one of Linux kernal modules since version 3.6 and it is designed for packet capturing. It is almost plug and play.
AF_PACKET can be running on a very low power consumption x86 computer, such as Intel Avoton C2750 Octa-Core CPU with 8GB RAM or more. This CPU is only running at 20W. I recommend to use at least 8GB RAM for home security purpose. More memory and faster as well as more cores Intel CPU for Home Office or larger business is suggested.
What Is My Home Network Looks Like?
I have 10Mbps internet connection. I do not run with any modem. I have a home router (TP-LINK TL-WR1043 v1.x with stock firmware). I have two home switches (TP-LINK TL-SG1008D, it is like a hub more than a switch in general).
I have a Linux web server, a Windows 7 desktop, several Linux boxes and some Mac machines as well as a Time Capsule. I connect these boxes to the home switches. I disabled the wireless function on my home router and use Time Capsule as wireless router and Time Machine for Mac machines.
I implement two IPS on my home network. The IPS is connected between ISP and the home router. The other IPS is connected between home router and home switches. Therefore, I can monitor the traffic outside and inside my home network. I do not trust internet and intranet at all.
What Is The Hardware?
I use Asrock Rack C2750D4I motherboard with one more Intel Gigabit Desktop LAN card as my IPS.
Since Asrock Rack C2750D4I motherboard comes with 2 network interfaces, I need one more Intel Gigabit Desktop network interface on each box for monitoring purpose.
I installed 32GB RAM and 320GB Hard Drive on each box as IPS.
Internet -- IPS -- router -- IPS -- switch -- PCs and Time Capsule (including web server)
How About The Installation?
I select Ubuntu 14.04.2 LTS Server as the OS of the IDS/IPS. Since the network interfaces of Asrock Rack C2750D4I are Intel i210, the name of the interfaces on Ubuntu 14.04 is p119p1 and p121p1. While the Intel Gigabit Desktop network interface is eth0.
Install Ubuntu Server on the Asrock Rack C2750D4I as usual. Make sure you only connect the network cable to one of the network interfaces. I recommend you to install the OpenSSH when asks. Update and/or upgrade the Ubuntu Server when necessary.
Download the Croissants from here. The current version at the time of this writing is version 0.1.2 dated July 01, 2015.
Please follow the instructions on the official site to install. Configure the nsm.conf. Make sure to remember the password of MySQL as it will be asked when install. The username and password of control panel (Snorby) will also be configured. At the end of the installation, you will be asked for the time zone. Please select UTC. By the way, you may notice that there will have some error warning on the screen when installing. You just ignore it.
After the installation is completed, you can plug in the other network cables. Then, reboot the box. One more important thing is that you should configure your router to either DHCP or static IP addresses. If you selected DHCP, make sure it is reserved for the monitor interfaces (that is the Intel Gigabit Desktop network interfaces). The p119p1 and p121p1 do not have any IP address.
If everything correct, you can access to the monitor interfaces by using your browser, such as http://192.168.20.180. Enter your pre-set username and password when login. At the top right corner, select "Settings" to configure your time zone. Make sure you enter your password at "Current password (we need your current password to confirm your changes)" and then update the settings.
At this moment, your two boxes are in IDS mode. How to enable it to IPS mode?
You may need to change the name of the Intel Gigabit Desktop network interfaces when they are changed unexpected. You can change the name back to eth0 with the following command :
Log in to the two boxes via ssh or terminal. Then run the following command to configure the DROP rules.
sudo nano /etc/pulledpork/dropsid.conf
I suggest to append the following lines at the end of the files. They will block most unwanted traffic.
# HTTP request header invalid
1:2221013
# HTTP missing host header
1:2221014
# masscan port scanner
1:2017615,1:2017616
# DOS possible ssdp amplification scan
1:2019102
# DoS attacks -- UDP & ICMP Invalid checksum & packet too small
1:2200075,1:2200038,1:2200076,1:2200024
# IP & TCP Invalid checksum
1:2200073,1:2200074
# TCP packet too small
1:2200033
# stream established retransmission packet before last ack
#1:2210021
# stream established packet out of window
#1:2210020
# GPL attack response id check returned root
1:2100498
# COMPROMISED & DROP & CINS Active Threats
pcre:ET\sCOMPROMISED
pcre:ET\sDROP
pcre:ET\sCINS
# MALWARE, TROJAN, WORM, MOBILE_MALWARE, Amplification DoS, DDoS
pcre:ET\sMALWARE
pcre:ET\sTROJAN
pcre:WORM
pcre:ET\sMOBILE_MALWARE
pcre:ET\sSCAN
#pcre:ET\sSHELLCODE
pcre:Amplification
pcre:ET\sDOS
pcre:ET\sEXPLOIT
pcre:ET\sUSER_AGENTS
pcre:ET\sWEB_SERVER
pcre:GPL\sSNMP
#pcre:SURICATA\sSTREAM
pcre:ET\sCURRENT_EVENTS
pcre:ET\sWEB_SPECIFIC_APPS
# Outgoing basic auth base64 http password
1:2006380
# Quantum Insert Attack (by NSA)
# (SURICATA STREAM reassembly overlap with different data - 2210050)
# (LOCAL QI 302 and possible inject - 12345)
# https://github.com/fox-it/quantuminsert/tree/master/detection/suricata
1:2210050,1:12345
# GPL WEB_SERVER 403 Forbidden
1:2101201
# ET POLICY Suspicious inbound to MSSQL port 1433
1:2010935
# ET POLICY Suspicious inbound to mySQL port 3306
1:2010937
# SURICATA HTTP Host header ambiguous
1:2221015
# ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
1:2016149
*** Please remember that you may enable some already disabled rules by the captioned setting. If you encounter any false positive alert, you can disable such rule(s) by the following.
sudo nano /etc/pulledpork/disablesid.conf
Append the following at the end of the file, for example.
# TROJAN 1.1.1.1
1:2017000
# DELETED
pcre:ET\sDELETED
# MOBILE_MALWARE Google Android Device HTTP Request
1:2012251
# MALWARE WhenUClick.com Weather App Checkin (2)
1:2000915
# SURICATA STREAM alerts
#pcre:SURICATA\sSTREAM
# SURICATA STREAM
#1:2210000-1:2210049
#1:2210051-1:2210057
# SURICATA STREAM alert when downloading
1:2210021
1:2210020
1:2210029
1:2210045
1:2200074
1:2210038
1:2210044
# ET CURRENT_EVENTS Possible Dynamic DNS Exploit Pack
1:2014445
# ET WEB_SERVER WebShell
1:2016683
1:2016992
# ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)
1:2009207
1:2009205
1:2009208
# ET TROJAN UPX compressed file download possible malware
1:2001046
# ET TROJAN VMProtect Packed Binary Inbound via HTTP
1:2009080
# ET WEB_SERVER Fake Googlebot UA 1 Inbound
#1:2015526
After that, you can reload the rules by the following command.
sudo nsm_cronjob_rules_update
or
sudo nsm_rules_update
How To Delete All Testing Traffic?
It is very easy to delete all testing traffic if you want to. However, it only delete all the traffic in the Snorby and leave all other setting untouched.
sudo nsm_snorby_db_reinstall
In addtion, I also suggest you to install anti-virus program on your Windows boxes for play safe. Meanwhile, you can classified the traffic on Snorby too.
The last thing should inform you that you are recommend to set the QoS at your router. Otherwise, the bandwidth will be consumed by one of the connections.
How About Performance Tuning?
You can follow this guide to tune the IDS/IPS to make it running more smoothly.
To have a more secured IDS/IPS, you can append the following line to the "/etc/fstab".
I developed NightHawk which allows users to use Tor Network in transparent mode. NightHawk has more advantage than Tor Browser. You not only can surfing the internet via Tor Network with your favorite browser but also can use any application software to connection to internet via Tor Network.
However, there are some restrictions to use NightHawk (or even Tor) safety in order to prevent your IP address from being leaked. First of all, you need to prevent DNS leaking by not using your ISP DNS. Secondary, you are advised not to install Flash on your browser as it has potential to leak your IP address when you visit a malicious website. Thirdly, make sure you do not use Google Search Engine as you may be banned by Google. Fourthly, make sure you disable javascript when possible. However, it is not possible to do so in modern websites. Javascript web pages are heavily implemented. Lastly, do not download as well as do not reverse connect back to your box via the Tor Network.
I think that there are only five restrictions to use Tor Network. When I seeing Chloe's research, I realized that there is one more restriction. It is, you make sure do not login to any website via Tor Network. According to the research, some exit nodes are sniffing traffic even some exit nodes are running for a very long time that granted "Guard" flag in the Tor Network.
In my opinion, HTTPS is also not safe for surfing via Tor Network with bad exit nodes. Chloe's project - BADONIONS - Honeypot the Honeypot can find exit nodes that sniffing traffic. I am waiting for the final result of the project and hope Chloe can release the bad exit nodes list to the public.
I am running Croissants - Intrusion Detection and Prevention System on Ubuntu 14.04.2 LTS Server. Recently Ubuntu update kills the networking features that making no IP address interface to fetch IP address. Even making the interface in promiscuous mode still fetches IP address on that mode. That would drop the performance of the Croissants with more than one IP address with the same subnet in the same system. After try and error, the workaround is as the following.
sudo nano /etc/network/flush-ip
ip addr flush dev p2p1
ip addr flush dev p4p1
ip -6 addr flush dev p2p1
ip -6 addr flush dev p4p1
* where p2p1 and p4p1 are the incoming and outgoing interfaces for Croissants
sudo chmod +x /etc/network/flush-ip
Create a cron job to flush the ipv4 and ipv6 address on every 15 minutes interval :
sudo crontab -e
Append the following line to the file :
*/5 * * * * /etc/network/flush-ip
To double check the cron job entry :
sudo crontab -l
The interfaces should be looking like this :
The ipv4 and ipv6 addresses of p2p1 and p4p1 have been deleted.
When the Kali cannot ping the internet on every boot up in VirtualBox, or the network interfaces is "Device Not Managed", or you cannot connect to PPTP VPN or similar, you can :
Shield is a very small device that can protect your home and small business network from being attack by malicious hackers. The attacks include viruses, scams, phishing, website and browser exploits as well as operating system and application exploits. Shield protects your incoming and outgoing traffic. Even your system or network is compromised before using Shield, malicious hackers cannot control and access your system or network any further when Shield is implemented. Shield is also protecting your system or network from being scanning of vulnerabilities. That is excellent for preventing your system or network from being attack.
Shield acts as Intrusion Prevention System (IPS) or Unified Threat Management System (UTM). When it acts as IPS, the core engine is Suricata (Intrusion Detection and Prevention System). It is the simplest way to implement the device and its throughput is more than 1 Gbps. When it acts as UTM, its core engine is Snort (Intrusion Detection and Prevention System). This mode has a lot of features, such as web content filtering, anti-virus, VPN, QoS and etc. However, the slower throughput is the drawback for UTM mode.
Suricata and Snort are using Emerging Threats Open Rules for the operation. Emerging Threats Open Rules include malicious IP addresses, virus signatures, exploit signatures and attack signatures. It also include scanner signatures. According to Suricata developers, the maximum throughput of Suricata is more then 30 Gbps.
Shield includes a free lifetime subscription to stay up-to-date against the latest threats with automatic essential security updates. There is no number of user limitation in the device. It is designed for general users with no professional training in Information Security. It is very easy to setup and use. Plug, Play and Forget!
Business or DIY
There are some UTM or IDS/IPS available in the market. Those devices are developed for business and the prices are not reasonable for home or small business users. The cost will be over $1,000-USD. Meanwhile, the power consumption of those devices would be higher than Shield. Shield is only between 10W and 15W. Commercial UTM or IDS/IPS will have number of users restriction as well as cost for subscription annually of the rules and services.
On the other hand, we can build an UTM with Untangle; or, we can build a Suricata or Snort based IDS/IPS without paying for the software. However, the cost of hardware would be higher than the Shield for sure. For example, this motherboard costs about $399.99-USD. You also need to purchase hard drive, memory and computer case too. The power consumption for this hardware is between 35W to 80W. Shield would be cost around $300-USD only.
Recommended Setup
We suggest to plug Shield between your modem (if any) or Internet Service Provider (ISP) and router (wired or wireless) in Bridge Mode for excellent performance and protection.
If you do not have any router or you have a slower internet connection and the speed of the intranet is less than 1 Gbps, Router Mode can be implemented. The setup for Bridge and Router Modes are very easy and simple. No skill is required, believe me.
IPS (Bridge Mode)
UTM (Router Mode)
Technical Specifications
- 2 x 1.0 GHz MIPS64 CPU
- 1 GB DDR3 RAM
- 4 GB eMMC
- 3 x 1 GB Ethernet
- 1 x RJ45 Serial console port
- 5 x 3.5 x 1 inches
- between 10W and 15W power consumption
Features
Router Mode and Gateway Mode (UTM)
- Snort Engine
- Emerging Threats Rules
- Intrusion Prevention
- Network Anti-Virus
- NAT Firewall
- Content Filtering
- Web Proxying
- Dynamic DNS
- SSLVPN
- Quality of Service
- Graphical Web User Interface
- Realtime Traffic Monitor
- Realtime Connection Monitor
- Advanced and Basic Mode
- 10 Mbps throughput
- Plus More!
Shield is well designed and the performance will not worse than other similar devices in the market. However, the price is rivalry. It is the first IDS/IPS/UTM for home users and small business. Being a Shield beta tester and developer of Croissants, I am fully satisfied with the performance, price, size and power consumption of Shield. It is really can be "Plug, Play and Forget!". Recommended!
VirtualBox is a virtual machine which can be running on desktop and server. We can running VirtualBox as server (Headless mode) with PHPVirtualBox as front end. PHPVirutalBox can be running with Apache flawlessly. However, I would like it to be running on Hiawatha. There is no database required for the Headless mode.
Part A - Hardware
Motherboard : ASRock Rack C2750D4I server board
CPU : Intel Atom C2750
RAM : 4 x 8GB (32GB) DDR3-1600
Hard Drive : 2 x Western Digital 4TB WD4000F9YZ
Western Digital 4TB WD4000F9YZ is not certified by ASRock, so, it cannot boot from SATA3 ports. The SATA2 ports are used in this case.
The performance of C2750 is similar to Xeon E3-1220L. Please the comparison page at here.
The power consumption of this setup is between 30W to 80W.
Make sure you have enabled "Virtualization" (VT-x) in the BIOS.
Part C.1 - Operating System and Software RAID 1 Installation
RAID 1 requires two hard drivers for the installation. When you are installing Ubuntu Server 14.04.2 LTS, you are required to do the partitioning. Select "Automatically partitioning" for each drive. The partitions will be (1) 1MB for "biosgrub"; (2) Free Space for root directory; and (3) Free Space for SWAP.
Then select "Configure Software RAID" to configure the Software RAID 1 on Free Space for root directory and Free Space for SWAP partitions. Do not RAID the "biosgrub" partitions. Set the "Free Space for root directory" to be mount at "/" and use as "Ext4 jouraling file system". Set the "Free Space for SWAP" to be used as "SWAP".
Finally, you should select to install "OpenSSH" when asked.
After the installation, your box can be booted up as expected. You can check the status of Software RAID 1 by the following commands :
cat /proc/mdstat
mdadm --detail /dev/md0
mdadm --detail /dev/md1
Make sure to change /etc/network/interfaces :
Add "allow-hotplug p119p1" just below "auto p119p1".
Part C.2 - VirtualBox Installation
After the Ubuntu Server 14.04.2 LTS is installed, you can install VirtualBox on it.
sudo nano /etc/apt/sources.list.d/vbox.list
Append the following line to it :
deb http://download.virtualbox.org/virtualbox/debian trusty contrib
wget http://www.cmake.org/files/v3.2/cmake-3.2.3.tar.gz
tar -xvzf cmake-3.2.3.tar.gz
cd cmake-3.2.3
./configure
make
sudo make install
wget http://www.hiawatha-webserver.org/files/hiawatha-9.13.tar.gz
tar -xzvf hiawatha-9.13.tar.gz
cd hiawatha-9.13/extra
./make_debian_package
cd ..
sudo dpkg -i hiawatha_9.13_amd64.deb
sudo nano /etc/php5/fpm/php.ini
Make changes as is.
zlib.output_compression = On
zlib.output_compression_level = 6
