Sunday, September 13, 2009

Tool Stew

I’m tired just looking at this list!

So I’m passing these links on to you so we can share the burden together.

Windows Base

Network Veggies

  • The other day I mentioned NetGrok which is a clever Java-based network traffic visualizer.  I never was able to get it working on my Win 7 system, nor the Vista builds.  I spend some more time with it on my XP Pro system and still couldn’t get it working.  The Java kept erroring a nullPointer message.  I did load it up in a fresh XP Pro Virtual PC build and after following the steps and using the latest Java release I did get it working.  Not sure where the conflict is.  One of the tricks I learned is that the groups.ini file that controls the grouping display doesn’t use standard IP notation.  Nope instead you have to set the IP addresses in Classless Inter-Domain Routing (CIDR) notation.  I hadn’t ran into this format before but it was easy to follow.  Do a CIDR Notation - Google Search and you should be set.  One more thing, when you do get it running you will then need to use the menu-bar option to set your network adapter it should use.  Once I got it working it was very slick and cool.  Only it locked up after just 10 minutes of running.  Maybe it was a VPC thing…  Still hoping…

  • NetGrok uses the Jpcap set.  No changes with the version that is included in the setup package for it, but there is the link for the curious and watchful.

  • Related, check out Analyzer: a public domain protocol analyzer.  It worked pretty simply with no fuss.  However, I think that while it has a few things that are interesting as a packet-sniffer, the usual ones such as Wireshark, NetWitness Investigator Software, and Microsoft Network Monitor 3.3 fit my needs better.  For the full list see the recently GSD blogged Network Capture Tools and Utilities post.

  • NetworkMiner Network Forensic Analysis Tool (NFAT) and Packet Sniffer was one of the high-points in that post and I just found out that it was updated to version 0.89.

  • ZeroRemote v1.2.5 - (freeware) – Spotted and offered by TinyApps.Org Blog. Although I highly recommend and depend on the free version of ShowMyPC, I’m looking forward to playing with this one as well.  If TinyApps recommends it, it must be good!  Also related: Microsoft SharedView.

Browser Flavorings

  • Chromium Blog: Extensions Status: On the Runway, Getting Ready for Take-Off – Extensions for Chrome/Chromium are now coming down the pipe.  Nothing spectacular (Sample Extensions) just yet but I’m betting this will snowball pretty fast now.

  • woanware has an amazing collection of system utilities and some forensic-related tools to boot.  Particularly impressive is ChromeForensics which parses out the contents of the user-profile for Chrome and Chromium builds very, very nicely.  I was having trouble getting it to work with my Google Portable Chrome build.  Woany patiently spent some time with me troubleshooting and diagnosing.  In the end it turned out to be a freaky corrupt (but working fine) user profile.  I built a fresh portable Chromium build,downloaded the latest Chromium buildbot/snapshots, transferred my bookmarks over into it, and ChromeForensics worked perfectly.  The “Thumbnail” tab view is really spectacular.  Tip:  when you browse to import the location point it to the \default folder.  On my Vista\Win7 the Chrome folder location used is “C:\Users\Claus\AppData\Local\Chromium\User Data\Default” and for Chromium the folder location is “C:\Users\Claus\AppData\Local\Google\Chrome\User Data\Default”.   A few related freeware apps (not woanware) : ChromeAnalysis, and ChromeCacheView.image

  • Silvermel :: Theme for Firefox. – I’m usually quite happy to stick with the standard/default Firefox theme. But I stumbled onto Silvermel and am overjoyed with it.  IT doesn’t remarkably differ from the default theme but it is much more polished and refined.  It looks smacking-delicious in NewsFox rendering.  The horizontal icon/bookmark spacing seems a bit wider than the default, but the vertical spacing is tighter. I’m not sure if the font is different but it seems easier to read to me.  Really classy theme.

  • NASA Night Launch :: Theme for Firefox and PitchDark for Fx :: Theme for Firefox.  Here are two very dark, almost “special-ops” looking themes for Firefox.  Nice for night-time viewing and/or when you need that edgy-techy dressed for success look for your fox.  It’s no small wonder that NASA Night Launch remains at the top of the most weekly downloads list for the Themes, beating the next popular theme almost 2-to-1.

Meaty Tools

  • SpaceSniffer - (freeware) – Yep one more hard-drive file/folder size visualizers (of many such great Pocket Hard-Drive Utilities).  I do like the text labels very nicely. It also supports several different views, can scan NTFS Alternative Data Streams, is portable (no install needed), and uses a XML file for saving settings…not the registry.  Nice!

  • InstEd -- (freeware) – I’ve used Orca (Microsoft's MSI editor) before to muck around with MSI files, as well as Universal Extractor to open them.  However InstEd comes highly recommended so I’m adding it to my toolkit.

  • ProcNetMonitor -- (freeware) – tool by Nagareshwar Talekar to help hunt down processes, to network connections, to ports.  See also CurrPorts, Process Explorer, and VStat.  ProcessNetMonitor combines several of these abilities into one package.  Spotted at PenTestIT. Nagareshwar actually has a very large collection of PenTesting and password breaching tools at his SecurityXploded website. Check them out. Don’t forget about Nir Sofer’s Password Tools collection as well.

  • Paint.NET v3.5 Alpha, build 3533 -- (freeware) – New version recently released (Alpha so be warned).  I’ve got it operationally deployed on my Win7 x64 system and it really is fast and smooth.  Get it if you want to live on the bleeding edge.  I didn’t fully appreciate the number of Paint.NET community built Paint.NET Plugins that are out there as well.  Normally the base-set of included filters and features of Paint.NET are more than sufficient for my needs, but some effects are pretty cool and nothing like using a good plugin to get that perfect effect.  The thumbnailer application ImageWalker has some cool image filters as well, though I find the older version to have a more robust filter/effect set.  PhotoFiltre is another stunning tool for applying custom filters to images.  The version “X” is not free, but version 6 is still freeware as are a few other tools as well on the page.

I don’t know about you, but I’m pretty full!

Pending one more post later tonight from the forensics front.

Cheers for now.

--Claus V.


JMisner said...

Hi Claus,

Just curious, what steps did you follow to eventually get Netgrok working at all? I've tried on both Win7 RTM x64 and XP Pro SP3 laptops, both with latest Java installed, and am having a similar nullpointer issue.

The program looks great if I could only get it working. Too bad the package looks like a mess, as it hasn't been updated in a year from what I can tell, and the batch file it comes with points at an old filename for execution.

You had mentioned "after following the steps" so I wasn't sure if I was missing something here.


Claus said...

@JMisner - NetGrok is teasingly nice. When I read the "whitepaper" it ended up showing a bit more sparse in the testing and application delivery than I had expected.

To get it working I;

1) Started with a fresh MS Windows XP pro build in a Virtual PC session. I think it was XP SP3.

2) I copied the unzipped folder into the VPC.

3) I downloaded and installed the last Java RE build under 1.5.x from FileHippo since getting it from Java was turning into a registration headache. Java Runtime Environment

4) I then downloaded and installed the latest Java RE build under 1.6.x Java Runtime Environment

5) I installed the WinPcap version for Windows that shipped in the NetGrok folder C:...\netgrok20080928\Netgrok\lib\windows

6) I installed the JpcapSetup file for Windows that shipped in the NetGrok folder C:...\netgrok20080928\Netgrok\lib\windows

7) I think I rebooted at this point.

8) I opened the “bat” file (netgrok20080928.bat) which is used to actually launch the Java app. and edited it so that the first line “java -jar netgrok20080902.jar” reads instead as “java -jar netgrok20080928.jar”

9) I then opened up the groups.ini file and removed the #2 and #2 items under [local] and after some trial, error, and Google work, figured out it was expecting the CIDR network address notation. So since I was using it at work and we had a pretty large network/subnet mask range it took me some extra time as well.

10) Once I got it all set correctly, I launched the .bat file which got the DOS Window open with no nullPointer errors, and then the Java window opened.

11) Nothing was happening so I figured out I then had to use the option in the menu bar to point to my physical network adapter on the host system.

That did the trick and the blobulous IP objects started poping up and doing their thing. As I said it ran for about 10 minutes and was still popping them in but I think it got overwhelmed and locked up. I was running it while everyone was logging into work as they hit the office in the morning.

According to the documentation, it sounded like they were using it with Java RE 1.6.x but maybe the 1.5.x or even a 1.4.x would be more "stable".

I really like the visualization it provides but it is very finicky and as you say, seems to have been abandoned.

Maybe someone will pick it up and spend some extra time with it...

The only thing besides a Java version issue causing the headache was possibly that I had the latest (beta) WinPcap release installed on my system proper (thanks to Wireshark).

By dumping it in a VPC session that didn't have that, it put the "older" stable version into play.

That's all I could think of...

Let me know if you find a trick I've missed!

Happy capturing!

--Claus V.

Miles said...

Aloha, Claus!

Unlike ShowMyPC, LogMeIn, Zolved, etc, ZeroRemote requires port forwarding any routers for access via WAN - I'd probably only use it for LAN desktop sharing. I asked IchiGeki about including support for reverse VNC connections (like UltraVNC Single Click), but he said it is not planned at the moment.

Sincerely, Miles

JMisner said...

Sorry, it's been a very busy few weeks around here. Thanks for your lengthy reply! I was able to get it working, thank you.

When searching for similar apps, I did stumble upon a lot of great networking apps I haven't check out yet. Take a look through the pages at some of these gems: