Showing posts with label NFAT. Show all posts
Showing posts with label NFAT. Show all posts

Monday, May 30, 2016

Network Link Roundup

And yet another pile of URL web-linkage. This collection focuses on network techniques, tools, and software releases.

Grab a fork and dig in!

Cheers.

Claus Valca

Posted by Claus at 0 comments
Labels: , , , , , , , ,

TRAINING: Windows Security & Forensics

“New” Microsoft Virtual Academy training course spotted.

Topics:

  1. Windows Security and Forensics
    Take a look at the current state of the security landscape, Windows Security, and what "computer forensics" are.
  2. Windows Memory Attacks and Forensics
    Learn how and why hackers attack a system’s memory, and see how Memory Forensics can help address the problem.
  3. Windows Authentication Attacks and Forensics
    See demonstrations of how attackers use credential dependencies to gain elevated access to systems and to perform lateral movement. Plus, learn how to detect and prevent many of these attacks.
  4. Windows Forensics
    Explore Digital Forensics, and find out what to do as a first responder to preserve evidence for legal actions.
  5. Network Forensics
    Explore network forensics, along with case studies, best practices, and online analysis techniques.
  6. Malware Incident Response
    Learn about malware incident response, including identifying, locating, and removing malware.
  7. Windows 10 Forensics
    Take a look at Windows 10 forensics, and hear about new security features and innovations that can help forensic experts with their work.

Learn the following through this course:

  • Examine how and why hackers attack a system’s memory.
  • Identify how attackers use credential dependencies to gain elevated access.
  • Review what to do as a first responder to an attack; learn to preserve evidence for legal actions.
  • Explore network forensics.
  • Learn about innovations of Windows 10 that can help forensic experts do their jobs.
  • Learn the basics of computer forensics.
  • See how to respond to malware incidents.

This won’t instantly make you a professional forensicator it looks to give sysadmins a well-rounded introduction into key topic and foundational approaches when deciding where to begin – if there isn’t already a formal support structure in your organization for these items.

Claus Valca

Posted by Claus at 0 comments
Labels: , , , ,

Sunday, July 12, 2015

Summer’s On! Super Sysadmin Linkfest

Little Bro and I just wrapped up some Saturn Ion A/C system repairs in the driveway. Got the chill winds blowing in the cabin again. So with that resolved, time looks available for a summer’s on, super sysadmin linkfest dump to cover all the bases.  (And expect another Shade-tree Saturn Ion Mechanic tip post very soon, too.)

CryptoPrevent (Foolish IT) News

I personally use and recommend the awesome CryptoPrevent Malware Prevention utility from Foolish IT.

It is simple to use, hasn’t caused me any issue with the default security level settings, and gives me the comfort of having an additional layer of protection against ransomware threats. The free version works nicely on our home systems.

If you are using CryptoPrevent, this technical post may be useful: CryptoPrevent, ShadowExplorer, and VSSADMIN - Foolish IT.

Foolish IT has been hard at work on a new version and this post shows some of the new features and GUI - CryptoPrevent v8 Teaser.

Alternative remain thirdtier.net’s Cryptolocker Prevention Kit (updated) over at Spiceworks.

Considering the rash of ransomware infections at work lately, I’m surprised the AD and security team hasn’t gotten together to review the settings in the prevention kit noted above.  Just say’n…

Malwarebytes Tips and Updates

How-To’s

In my GSD post (mostly) Fast burn video file to DVD-playable format I ended up using DVDStyler Portable to burn some miscellaneous video files to a DVD. I really wanted to use DVD Flick (see this interesting comment thread and this one too regarding a portable version) but problems and a limited amount of time to solution the issue prevented a real trial. I had also found this Free Video to DVD Converter at DVDVideoSoft .

So it was with interest I spotted this post that looks like it could do the job as well.

The app mentioned was Freemake Video Converter. It is clearly stated in the post and in the comments that the application comes bundled with OpenCandy that may be tricky to decline installation thereof. A comment in the thread recommended running the installer from the command-line with the “/nocandy” switch. I tried that and it seemed to work. When you download the installer off the product web-site it is just a “stub downloaded” which then fetches and retrieves/installs the “full” package. In my case it was:

C:\Users\<PROFILEID>\Downloads\FreeVideoToDVDConverter.exe /nocandy

A follow-up scan with Malwarebytes Anti-malware come back clean (…well except where it found it embedded in the full app download package placed in the TEMP folder) and it always detects OpenCandy in installer packs (based on my personal experiences).

So here is a fourth option worth considering if you need a free utility to burn various video files into a single DVD compilation.

Passwords

I’m a hard-core user of the free KeePass Password Safe & MiniKeePass (iOS) utility. That said, I have to confess that it is very challenging keeping the core database synced between mine and Lavie’s various iDevices and laptops. Add to the fact that the master password datebase file is a hot target for hacking with all the keys to the kingdom I’m sincerely open to a new model for complex/random password management. And at work KeePass (and all password managers) are not approved software so I have to do a super-kludgy solution with using a Bitlocker volume file.

Master Password – project page.  Thanks to the TinyApps blogger I’m now very intrigued and will likely be seeing if I can incorporate this into my routine. There is lots of documentation available (both on TinyApps’ post and on the project page) and is is all very human-readable. The desktop version is a Java app so there is that “issue” if you are on Windows and have stripped Java from your system, though I guess you could go with jPortable and the jPortable Launcher from portable apps as a compromise. The developer also has a beta version of a Web app that could work.

Encrypting Windows Hard Drives - Schneier on Security

Network Nuggets

TraceWrangler – Jasper Bongertz’s awesome tool for sanitizing and anonymizing trace files was updated a while back to beta build 0.4.0 build 616 in x32/x64 flavors. ChangeLog. Sadly, I don’t (yet) do the twitter so there doesn’t seem to be an RSS alternative to watching for update releases without stopping by for a visit from time to time. Update! Jasper Bongertz has kindly now updated the project page to include a RSS feed! Awesome and many thanks! See also these recent posts by Jasper:

Link to test –> Speed test – DSLReports

Note to get the application to run successfully in Firefox (running NoScript) I had to temporarily do the following:

Adblock, or NOSCRIPT - is blocking access to remote IPs (not scripts).
Set NOSCRIPT>Options>Advanced>Trusted>Cascade top document.

Once testing was done, I disabled that option setting.

New or Interesting Utilities

SimpleWMIView reminded me a bit of WMI Explorer over at CodePlex. Probably would be complimentary apps.

SterJo NetStalker – SterJo Software – This is an interesting app. I particularly like that it comes in a portable version. As noted in the gHacks post, it is very similar to (but with some differences) to Nir Sofer’s CurrPorts utility.

At the church-house we run a program called Shelby Systems. It is a client/server based model and though most all of the systems have the client software on it, only one user in particular is constantly having issues connecting to the server unless we shut-down the (Windows) server’s firewall, allow the client communication to establish, then turn on the firewall again. So it looks like the server firewall has some not-yet-located firewall rule in play not set correctly. I’m hoping that this and/or CurrPorts can help us hone in on the specific issue. If I do solve it, I’ll post a troubleshooting guide.

SterJo Software – Products – SterJo offers a number of freeware utilities that may be of use to some sysadmins.

Troubleshooting Tips from the Pros

Windows SysAdmin Tips and Techniques

Microsoft Trainings and Infographics

Kali & Docker

McAfee & The Great Stinger “feature update” Debacle

So McAfee’s standalone Stinger AV tool is/has-been/was a great tool to run in an attempt to scan a system for specific threats and attempt to neutralize/remove them.  It is updated often with new definition patterns and has been a long-time tool in the GSD infection response toolkit.

However a while back an uproar occurred when it was found a new version upgrade with enhanced features left a running/persistent McAfee service (the 'McAfee Validation Trust Protection Service' mfevtps.exe) on your system afterward; even when the binary was removed, and with no clear way to remove it.

It seemed that the only way to really “clean” your system from McAfee after you tried to clean your system with McAfee’s Stinger was to follow these steps: How to uninstall or re-install supported McAfee products using the Consumer Products Removal tool

Only what I didn’t see in the aftermath were any notices that McAfee reported the persistent service module everyone was hollering about was due to a bug in the application. It was quickly fixed and now Stinger behaves the way it used to, fully cleaning itself up after run.

PortableApps McAfee Stinger news Comment thread post. From that comment..

John - thanks for reporting this issue.

The McAfee Validation Trust Protection Service is needed for Stinger to perform rootkit scanning of a system. This service is temporarily installed during a Stinger scan and is removed once the rootkit scanning portion is completed.

In a recent update to the Stinger's rootkit scanning engine, an issue was found where it wasn't getting uninstalled in certain conditions. We've fixed that in last week's release. The latest Stinger available for download should not leave behind any components post a scan.

Please let me know if you require any other clarification.

Best,
Vinoo Thomas
Product Manager, McAfee Labs

Possibly interesting (or conversational) but not related to McAfee Stinger debacle - Beware: Free Antivirus Isn’t Really Free Anymore – How-To Geek blog. I may come back to this post in more detail at a future time…

Microsoft Surface / Surface Pro News & Tips

iOS 9 Peeks & Misc Apple News

I’m really excited to see some dual-tasking coming to the iPad device in iOS 9!

Whew!

--Claus V.

Posted by Claus at 2 comments
Labels: , , , , , , , , , , , , ,

Saturday, June 20, 2015

FireCAT 2.0: What’s that hot kitty been up to?

I was reading with interest a recent post Turn Firefox into a Security Information Powerhouse at gHacks Tech News.

Martin Brinkmann did a very good job lining up a collection of Firefox extension that most regular users might indeed find helpful expanding user-security while browsing.

Please read Brinkmann’s full post for his take on the value of each extension and the feature set.

It’s a pretty good roundup and while I might not be too keen to load them all up in a web-browser, more than a few could be useful.

However, it seemed a bit thin to be used with the description “powerhouse” when it comes to security-related Add-on integration with Firefox.

See, this post jogged my memory cells and called me back to a GSD post from 2009 that introduced FireCAT to Mozilla’s browser.

Both of these tools brought be back to the excellent FireCAT 1.5 collection of Firefox add-ons used for security/network/pen-testing and other high-value activity in Firefox. FireCAT is maintained by Security Database Tools Watch.  Check out this FireCAT 1.5 PDF for the full list and if you don’t want to pick-n-choose hop over to the lover-ly Firecat package for Firefox Files on SourceForge.net to get the whole collection at once.  What surprises me is that no-one has yet submitted it as Firefox Add-ons Collection.  Looks like I may need to crank up a “standalone” profile of Firefox called FireCAT, install them all, then upload the collection like I did for my Claus Valca’s Extension List (Home)   What think thee? Useful perhaps?

I did follow that post up with actually building a FireCAT 1.5 "Plus" Edition collection.

So after reading the gHacks post I got digging to see if FireCAT was still around and worthy of delivering a true security “powerhouse” for Firefox.

Turns out it was updated back in 2013.

FireCAT: Firefox Catalog of Auditing exTensions – version 2.0

There are now over 90 different security focused extensions in the list covering areas such as information gathering, proxies, web page/code editors, network utilities, IT-security, and application auditing, Check out the catalog page for the list.

Besides the newer extensions since the previous version, the developers also worked towards melding FireCAT with OWASP Mantra.

Granted, this is a few years old, but could still form a good framework to bring forward for your own personal needs. I don’t (yet) know how many of the extensions are compatible with the newest Firefox build versions.

More:

Given that it’s been another two years since that publishing, I’m betting that FireCAT 2.0 could probably be updated to version 2.5 with even more extensions that have come out since.

BTW…would a Chrome/Chromium based version be called ChromeCAT or Cr(24)CAT? 

A customized portable version of Firefox (or Chrome) coupled with a bevy of FireCAT /CR(24)CAT extensions sounds like an incredible portable network toolkit. Now that is what I could call a browser-based security powerhouse.

I feel a new challenge coming on!

(This is why I struggle to get things done on the weekends around the house…)

Cheers!

--Claus Valca

Posted by Claus at 0 comments
Labels: , , , ,

Sunday, February 08, 2015

Network Tools and Tips – Linkfest

Here are a bunch of tools and tips for you network support geeks.

Whew!

--Claus Valca

Posted by Claus at 0 comments
Labels: , , , , , ,

Sunday, December 21, 2014

Super-Scale ForSec Linkpost

I think this post is going to have the same number of URLs as Christmas tree ornaments and mantle decorations that I hung and set out this afternoon. That’s to say there are a lot, and I am quite behind when considering the calendar.

I’ve been collecting these for at least two months and there are too many now to continue to put off posting them for reference. I’ve tried to group them somewhat for consistency in theme.

Exploits

Advice and Guidance

AV/AM

Analysis

Web Security

Network Bits

In the Library (mostly whitepapers)

Note: Many of these are PDF links and will open in your web-browser as a PDF…

Live CD News

Whew!

Cheers!

--Claus Valca

Posted by Claus at 0 comments
Labels: , , , , , , , , , ,

Saturday, December 20, 2014

Sysadmin Links - QuickPost

Stand back from your browser! Here comes a messy GSD Quickpost with tons of linkage for sysadmins….

New or Useful Software

PowerShell

Windows Diagnostic tool “PerfView”

  • Download PerfView - Microsoft Download Center - This little gem of a Windows performance collection tool is sweet! I’m really loving the easy of its data collection.
  • PerfView Tutorial - Channel 9 - Different video series than the “Defag Tools” listed below, Vance Morrison has some short mini-videos reviewing the tool, its usage, and some example applications. Good stuff!

Additional videos that are longer and more detailed on the tool.

Tips and Tricks

Windows 10

Windows/Updating

Network Nuggets

Cheers!

Claus Valca

Posted by Claus at 0 comments
Labels: , , , , , , , , , , , , ,

Saturday, October 04, 2014

New and Improved Utilities

Network Stuff Found and Updated

Which brings me back to the pretty cool Windows “firewall” application GlassWire. Previously featured via tinyapps.org, I spotted a new review of it that had some fresh examples of its usefulness; illustrating alert event marking for later examination. In one case, it helped a user discover network activity from malware that had gone undetected.

Then in those comments there was a reference to the KDE application KNemo - Network Monitor.

Utilities of Usefulness

  • AOMEI PE Builder - I’m always keeping one eye open on new WinPE building tools and this seems useful for the non-tech crowd who may not be up to taking on a project from the WinBuilder tool or one of the many specialized building sets at reboot.pro. For someone just getting their feet wet, this might be a good place to get started.
  • OPSWAT AppRemover - I keep rediscovering this tool every year or so. It is updated regularly and can aid in the removal of many Supported Applications. Good for a first-pass on a new OEM system.
  • GEGeek Tech Toolkit - Considering the work I do finding and maintaining all the tools and utilities on my own USB stick, this seems like a cheat, but if you are lazy, here you go. Related are the NirLauncher package builder and KLS Soft’s WSCC - Windows System Control Center (also update to version 2.3.0.1 as of Sept 2014).
  • OpenSaveFilesView - NirSoft - new utility that displays files previously opened with the open/save dialog box. More on NirBlog.  Spotted via this Betanews post.
  • FixWin v 2 for Windows 8, Windows 8.1 - The Windows Club - Easy but powerful tool to fix common Windows issues. Use with caution. Similar tool may be (the no longer developed but still available) d7 Free tool from Foolish IT LLC.

Lights, Sound, Action!

Cheers,

Claus Valca

Posted by Claus at 0 comments
Labels: , , , , , , , ,

Monday, September 01, 2014

Network News Nuggets

Yes. I’m in the process of emptying out my “to blog” hopper.

Bear with me. The next several posts will be positively boring as I get them up for future reference.

NetworkMiner 1.6 Released - NETRESEC Blog; drag and drop support, improved email extraction handling, DNS analysis, live sniffing performance improvements, PCAP-over-IP remote sniffing added to the free version.

PCAP or it didn't happen - NETRESEC Blog

Wireshark 1.12 Officially Released! - Sniff free or die. Wireshark download

Wireshark 2 Preview (by Tony Fortunato) - LoveMyTool blog

Wireshark: A Guide to Color My Packets - PDF whitepaper at SANS Institute Infosec Reading Room

The trouble with multiple capture interfaces - Packet Foo

Security Analytics: having fun with Splunk and a packet capture file (pcap) - PDF whitepaper at SANS Institute Infosec Reading Room

Network Forensics Puzzle Contest 2014 Walkthrough - Network Forensics Puzzle Contest

Data vs. Metadata - F-Secure Weblog : News from the Lab

The Routing Wall of Shame - IEEE Spectrum

Small devices needs a large Firewall - PDF whitepaper at SANS Institute Infosec Reading Room

Snort on home routers - what a great idea -ZDNet

ntop - It has been a while since I worked with took, but as of August 13th, version 1.2 was released. Worth checking into.

Top 5 Network Monitoring Tools for Windows 8 / 7 - The Windows Club - Nice and simple list of some networking monitoring tools you may already be familiar with, or not.

Cheers!

--Claus V.

Posted by Claus at 0 comments
Labels: , , , ,

Saturday, April 26, 2014

Playing Nicely Now: Xplico 1.1.0 & Ubuntu 14.04 LTS

OK, in the grand scheme of World Events, getting the latest Xplico release to update/install in the latest Ubuntu LTS release isn’t that critical.

But it does get frustrating when something so easily-difficult turns into being something a case of something so difficultly-easy to solution.

Submitted for your entertainment and education, upgrading both Ubuntu 14.04 LTS and Xplico 1.1.0.

I’ve covered more than a few guides now here at GSD on getting Ubuntu upgraded in my VirtualBox session. Each time it goes a bit more smoothly than the last.

Likewise, getting Xplico installed the very first time on my own (rather than using it in a pre-bundled virutal machine appliance or LiveCD distro) was quite the effort.

Fortunately, after contacting the wonderful team at Xplico, they added some super-easy “scripts” to their wiki page to make the process a breeze for Ubuntu builds up though 13.10.

So what could go wrong this time?

Apparently still quite a lot.

First, let’s cover the Ubuntu upgrade using the well-worn GSD process.

Here you go…documented for your entertainment and my education.

  1. Find in RSS feeds that my Ubuntu 13.04 Raring Ringtail install has a Ubuntu 14.04 LTS Trusty Tahr update available.
    ●  Ubuntu 14.04 review: Missing the boat on big changes - Ars Technica
    ●  Ubuntu 14.04 "Trusty Tahr" Brings Small Changes, Long-Term Support - Lifehacker
    ●  Ubuntu 14.04 LTS is here -- Linux fans, download it now! - Betanews
    ●  Ubuntu 14.04 review: Trusty Tahr adds finesse and choices to the Ubuntu desktop - Desktop Linux Reviews
    ●  TrustyTahr/ReleaseNotes - Ubuntu Wiki
  2. Made sure my Oracle VM VirtualBox platform I run it is is current. Upgrade accordingly first.
  3. Excitedly start the in-place upgrade of my VirtualBox Ubuntu build.
  4. Play it safe to prevent VirtualBox upgrades messing with Ubuntu by first disabling 3D acceleration in the VM machine settings.
    hk3ijk2t.dbz
    Then install/upgraded to the latest VirtualBox Extension pack within Ubuntu proper. Unlike last time I knew what the correct option clicks to get the Extension pack installer auto-running after I mounted the CD/ISO file.
    1. First, run the installer from the host.
      rlkvvpwv.u4z
    2. Next choose the “Ask what to do” option.
      egm215wp.p3c
    3. Run the auto installer
      zdshppbk.nv0
    4. Authenticate and install
      rf4k25to.2tb
      ●  How do I install Guest Additions in VirtualBox? - Ask Ubuntu.
      ●  Installing Guest Additions on Ubuntu - VirtualBoxes
  5. Once done, I rebooted the system after re-enabling the 3D Acceleration option in the VM settings.
  6. From there I continue my previous successes by using Daniel Benny Simanjuntak’s tip in a previous Ubuntu post comments to run the following command from the terminal to start the upgrade process.
         …through terminal one can upgrade as well using the command:
          sudo do-release-upgrade -d
  7. For an alternative method found check out this Upgrade Ubuntu 13.10 (Saucy Salamander) to Ubuntu 14.04 (Trusty Tahr) via Tecmint.com post.
  8. Let it run for a while…do a few reboots…looks like a Flash package is causing some non-fatal errors…moving on anyway… 
  9. When it is all settled down, I log in and kick the tires a bit, and change the desktop to the more dramatic “Sea Fury” image from the pickings offered.
    zy43p4pb.tg0
  10. Looked for and updated any pending applications needing updating. Done.
  11. Check “Upgrade to Trusty Tahr” off my to-do list.

So far so good.

Second, let’s cover getting Xplico working again.

So despite some fairly recent updates with Xplico - Open Source Network Forensic Analysis Tool (NFAT) having come out, for my simple purposes, I’ve been running the Xplico 1.0.0 version up to this point in my previous Ubuntu builds.

As previously mentioned, the Xplico development team (specifically the most gracious and patient Gianluca Costa) kindly corresponded with me after I asked some follow-up questions to my Self-Installing Xplico in Ubuntu post. That eventually helped lead in a small way to:

  • Xplico 1.0.0 Released - with notice of the new Xplico Repository and
  • the fantastically helpful ubuntu page in the Xplico Wiki giving you the following install options from:
    • The Xplico Repository (currently for Ubuntu 11.04 through 13.10)
    • SourceForge for both Ubuntu 12.04 and Ubuntu 11.04 & 11.10)

Knowing that the Xplico team had recently released Xplico 1.1.0 in late December with some nice feature enhancements, I thought it was finally time to do the upgrade.

First, I launched Xplico 1.0.0 from within my Trusty Tahr machine…and it completely and totally failed to work.

Might have something to do with all that “Apache” stuff I noticed going on during the upgrade to 14.04 LTS perhaps?

No problem…I’ll just go back and reinstall the older Xplico 1.0.0 version using any of those handy Xplico “scripts” on the Wiki page.

Fail.

My first attempt was to use the first installation method from the Xplico repository.

That seemed to “mostly” work except it didn’t really work cause embedded in all the Terminal output were these potential issues:

Err http://repo.xplico.org trusty/main i386 Packages                          
  404  Not Found

and

W: Failed to fetch http://repo.xplico.org/dists/trusty/main/binary-i386/Packages  404  Not Found

E: Some index files failed to download. They have been ignored, or old ones used instead.

Yep…not going to work or continue with the build process with those buggers.

OK, lets move on to the SourceForge package source/method.

Snap, same errors…

Well, granted, I may have been rushing things out the door, maybe waiting a few days would help and the repositories could just happen to be off line.

So I came back a few days later (OK, just this morning) and tried again netting the same results.

So, being a somewhat clever and resourceful person, I did what most folks wouldn’t dare think about doing to fix a technical problem in a area (Ubuntu) they don’t know enough about; I fired up the email and asked for help from the most gracious and patient Gianluca Costa.  Funny thing is his email to me back from January 2012 is still sitting in my Inbox, one of about 8 emails I keep there for quick reference or encouragement. I knew there was a reason for that.

Less than 30 minutes later, from across the globe, came a wonderfully helpful response with the following critical bits amongst some other nice content:

If you like to test the 14.04 packages, their links are:
http://projects.xplico.org/xplico_1.1.0-14.04_amd64.deb
http://projects.xplico.org/xplico_1.1.0-14.04_i386.deb

After checking with him first, Gianluca kindly allowed me permission to share that information with you. Please do note these are still a work in progress and some fine-tuning might occur before their “public” release which should happen very soon...but if you are struggling for Xplico 1.1.0 to get working and just can’t wait, there you go.

Probably for a seasoned Ubuntu professional, that would be all the information needed to get Xplico going again…alas…not so much for me; at first.

Here’s how I finally got it going about an hour after getting the package repository links.

Now to be clear and fair, I did need to make some fresh coffee during the process. So it didn’t really take me an hour total! But then again in more honesty, I made the fresh coffee using a K-cup machine Mom and little Bro gifted me for house-sitting…so the coffee making process didn’t take as long as one might think. Seriously…just a few minutes. Cheese-and-crackers! …now that explanation seems to make it look like it did take me closer to an hour…umm maybe I slowed down to savor that rich Italian roast blend I had to honor Gianluca for his reply?

Moving on…

  1. In Ubuntu, I opened up Firefox and downloaded the “xplico_1.1.0-14.04_i386.deb” package to my downloads folder.
  2. I then right-clicked the package and selected Open With the “GDebi Package Installer” as that seemed as cool a thing to do as either of the options offered.
    5zyleuxy.k1z
  3. It needed some prompts answered, but it ran OK until near the end when I got this:
    oclyluha.buq[5]
  4. That did NOT look promising…but I can follow instructions like a few people can
  5. I opened a fresh Terminal window and ran “sudo apt-get install -f”
  6. That did a bunch more things. I’ve saved the text output to place with Alvis’s early macaroni art pictures from kindergarten class but here are the highpoints (yes…I’m leaving some things out for brevity…like that matters at this point in the blog post):

      The following packages were automatically installed and are no longer required:
        libquvi-scripts libquvi7
      Use 'apt-get autoremove' to remove them.
      The following extra packages will be installed:
        apache2 libapache2-mod-php5 libpq5 python3-psycopg2
      Suggested packages:
        apache2-doc apache2-suexec-pristine apache2-suexec-custom php-pear
        python-psycopg2-doc
      The following NEW packages will be installed:
        apache2 libapache2-mod-php5 libpq5 python3-psycopg2
      0 upgraded, 4 newly installed, 0 to remove and 10 not upgraded.

      Setting up libpq5 (9.3.4-1) ...
      Setting up python3-psycopg2 (2.4.5-1build5) ...
      Setting up apache2 (2.4.7-1ubuntu4) ...
      * Restarting web server apache2

      Setting up libapache2-mod-php5 (5.5.9+dfsg-1ubuntu4) ...
      php5_invoke: Enable module pdo_sqlite for apache2 SAPI
      php5_invoke: Enable module opcache for apache2 SAPI
      php5_invoke: Enable module readline for apache2 SAPI
      php5_invoke: Enable module json for apache2 SAPI
      php5_invoke: Enable module sqlite3 for apache2 SAPI
      php5_invoke: Enable module pdo for apache2 SAPI
      apache2_invoke: Enable module php5
      * Restarting web server apache2

      Setting up xplico (1.1.0-14.04) ...
      Installing new version of config file /etc/apache2/sites-available/xplico ...
      Installing new version of config file /etc/init.d/xplico ...
      Module php5 already enabled
      Module rewrite already enabled
      * Starting  Xplico 

    1. Done! And those [OK] tags I saw in the process were very comforting.
    2. I then relaunched Firefox using a custom profile setting I have configured for Xplico usage and browsed to “http://localhost:9876/users/login”
    3. Looking like this may turn out well!
      dk5fjo34.qdm
    4. Logging in and looking at my testing “cases” everything was back to normal again. Sweet!
      gefm2xcy.g34
      Note: PCAP file shown above collected from Network Forensics Puzzle Contest site; contest #3.
    5. Next I logged in as admin to check out the installation details to confirm Xplico was 1.1.0
      4njasmdb.hr0
    6. Yep! It’s a little hard to see there but here you go.
      z5eii1xn.wbc
    7. All is well.

    Xplico 1.1.0 is now running nicely in my Ubuntu 14.04 LTS virtual machine.

    I’m even more wiser for the process thanks to the kindness of the developer.

    I’ve got another blog post to add to the (eventual) GSD Xplico mega post that I keep collecting more material for.

    All is well in the world!

    Cheers!

    Claus Valca

     

    P.S. More images from the “xplico_1.1.0-14.04_i386.deb” deb package details when it was all said and done for the curious

    Xplico 1.0.0 [Running] - Oracle VM VirtualBox_2014-04-26_10-18-06

    Xplico 1.0.0 [Running] - Oracle VM VirtualBox_2014-04-26_10-18-32

    Posted by Claus at 0 comments
    Labels: , , , , , ,

    Notes on Network-y Stuff

    Here is a linkpost on network-related topics for the forsec and sysadmin crowds.

    Cheers,

    Claus V.

    Posted by Claus at 0 comments
    Labels: , , , ,
    Subscribe to: Posts (Atom)