Network Traffic Capture in Virtual Environments
This post demonstrates how to mirror interfaces on a virtual private server (VPS) in a cloud environment, e.g. virtual machine (VM) on a hypervisor where you …
Technical notes
Articles
Security engineering notes, network defense walkthroughs, and practical technical references.
Network Traffic Capture on Linux using OpenvSwitch
This post demonstrates how you can mirror interfaces on a Linux server in an environment where you may not have physical network taps or SPAN ports. We can u…
Benchmarking Websites with ab and tsung
Everyone appreciates a responsive website, and because I host several, I am always looking for ways to improve their performance. Previously, I was interested in, HTTP, HTTPS, and HTTP…
Detecting Tor traffic with Bro network traffic analyzer
This article is part of a series on identifying Tor network traffic with the Bro Network Security Monitor, now known as Zeek. This post is not to argue the merits of allowing Tor to run on a network…
SiLK Network Traffic Analysis Visualization with R and Rayon
In this post, the process for retroactively identifying and graphing an HTTPS DDoS of service condition is described. Why do we care about graphing, because i…
Graphing Namebench Spreadsheet Data with R
In the previous post, I described the process of benchmarking domain name servers for a website domain with a modified version of Namebench. Namebench genera…
Benchmarking Website Domain Name Servers
This post evaluates a few methods to benchmark name servers that provide resolution of your website's domain name to its respective IP address. While DNS reso…
Building Apache and ModSecurity from source
This article describes how to deploy ModSecurity on a reverse proxy to protect several WordPress sites that I host. There are numerous guides describing how to ModS…
Redirect HTTP to HTTPS using Varnish
I recently enabled HTTPS on this site and wanted to use a 301 redirect in order to correctly re-route guests from HTTP to HTTPS (HTTP to SSL/TLS). I original…
Making WordPress Fast
This site previously used WordPress as a CMS platform. Quite a bit of time was spent tuning in order to get page load times that were consistently less then …
Parsing Microsoft DNS Server Logs
This is a quick post about one of many ways you may want to parse Microsoft DNS server logs. In this case, I simply wanted to know the top talkers. We use she…
Parsing Netflow using Kibana via Logstash to ElasticSearch
This blog entry shows how to easily insert flow data into an ElasticSearch instance using Logstash and view the data using Kibana. To keep the example simple…
Detecting Tor Network Traffic with YAF and Python
This article demonstrates how to parse historical YAF mediator output with Python and identify TLS certificate fields that matched patterns used by Tor relays at the time…
Detecting Tor network traffic with SiLK
This article continues a series on identifying Tor network traffic. It demonstrates how to build a SiLK IP set containing known Tor relay addresses and compare that set with collected flow records…
Resizing Xen guest partition based filesystems
This post assumes you are running the Xen hypervisor and are using a partition-based filesystem for your Xen guest you would like to re-size. I have previou…
Creating a Debian Guest on Xen Using a Partition-Based Filesystem
Create a Debian Xen guest using an LVM logical volume, Debian installer kernel, and Xen xl configuration files.
Installing Xen on CentOS 6 from source
I recently had a need to install Xen hypervisor on CentOS and most of the guides covered using the package maintainer's version. Further, RHEL distributions f…
Passive DNS collection and analysis using YaF and Mediator
Passive DNS is a useful tool for any analyst team's toolbox, I have noted several public sensors here but they only see data (queries and responses) that tra…
Running Moloch
This is an overview of installing and running Moloch on a single host. After seeing the 2013 ShmooCon presentation, I have been looking forward to giving the…
Increment IP packet timestamp
I recently had a need to specify and increment the IP timestamp values of packets in a PCAP. In this example, the starting second value is specified and we i…
Decoding an XOR-Encoded Payload Using Its First Few Bytes as the Key
I recently came across the need to decode an exclusive or (XOR) payload. In my case, the key to de-obfuscating the traffic was the first three bytes of each …
How-to setup an Upside-Down-Ternet
In an effort to replicate the amusing idea of a transparent proxy that manipulates traffic in a fun way found here and made even better with some great scrip…
Variance in rwfilter results from netflow v5 and YaF
Looking over some netflow data I notice some variance between the two sensors. Sensor s0 is v5 netflow data from a Cisco switch, s1 is from a network tap lis…
Configure YAF on Linux for NetFlow collection from a network tap or SPAN
In a previous post SiLK was set up on a Debian host using NetFlow v5 from a Cisco switch. This worked well but I also have a network tap and said Cisco switch…
Configure SiLK on Linux for NetFlow collection from a Cisco router
This guide explains how to build and configure SiLK from source on a Debian 6 host to collect NetFlow data exported by a Cisco router. …
Running Linux Retina and Nessus vulnerability scans with least privileges
When you are running those vulnerability scans of Linux and UNIX hosts I hope that you are following best practices for keeping a host secure during the proc…
Google namebench to find optimal nameservers
I was recently checking name servers that I was using to resolve hosts on a network. After using tools such as ping, traceroute, and dig I decided to search …
Python File Uploader
I recently had a need to upload large files to a server via HTTP. Most of the solutions required tweaking the web server or PHP. Instead, I found a Python sc…
Debian Backup Script
The script is available on GitHub. It can update a Debian system through APT, back up selected filesystems and databases, and transfer the resulting archives to a remote system over SSH…
Using session-monitor to span ports as an aggregation tap
Like most I do not have the funds to purchase a $1000 port aggregation tap for my IDS to monitor traffic so instead I just used a 2950 Cisco Switch…
Erase slack space on Microsoft Windows
A lot of information may be stored on a drive's slack space. If you want to get rid of these artifacts then run the usual tools to clean up the system like 'D…
Mounting read-only drive volumes in Microsoft Windows
To analyze a drive without hardware write blocker, I wanted to mount the drive in read-only mode. I do not have a write blocker and rather then fire up a copy of Helix or a similar tool
Authenticating kerberos against active directory
Your /etc/pam.d/system-auth is created with the command "authconfig" on a RHEL5 machine though you may have to manually edit it with other distributions…
Edit group policy on remote computer
To open up the MMC of a local Group Policy on a remote machinego to Start -> Run and type
NFS howto with static ports
First I am going to edit the /etc/sysconfig/nfs to specify the ports I want to run on. STATDPORT=4000 STATDOUTGOINGPORT=4004 LOCKDTCPPORT=4001 LOCKDUDPP…
SQL injection attack on a PostgreSQL database (t_jiaozhu)
A web server running Apache 2 and PostgreSQL was successfully compromised using a SQL injection vulnerability. I first noticed there was a new table in one o…