cutaway

== Configuration Updates ==

• Towards a Quieter Firefox: https://www.blackhillsinfosec.com/towards-quieter-firefox/

== Plugins ==

• FoxyProxy Standard
• Flagfox
• Cookie Manager
• Hackbar

cutaway

import os,sys
from ipwhois import IPWhois
import socket
import warnings

# Supress warnings
warnings.filterwarnings('ignore')

# Set field names
f = ['asn','asn_cidr','nets','query','asn_description']

cutaway

Unix

Sorting

• Sorting by month and day:
  • sort -k1,1M -k2,2n
  • http://stackoverflow.com/questions/12162210/sort-by-just-month-name-and-day-bash
• Sorting IP Addresses
  • sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4
  • https://www.madboa.com/geek/sort-addr/
• Uniq only counts the instances that are close to each other, so sort first:
• cat | sort | uniq -c

cutaway

#!/usr/bin/env python

import sys
from pyparsing import Word, alphas, Suppress, Combine, nums, string, Optional, Regex
#from time import strftime
import time
from datetime import datetime

# Script: ssh_accepted_xlog_parser.py
# Author: Don C. Weber (cutaway)

cutaway

Accessing EXT2/3 Image Files In Windows:

When doing forensics, the challenge usually is how can we access data when there are restrictions to the ways we can access the data. For instance, we have recently acquired a Linux disk formatted using EXT3. The acquired disk is a raw image file that is easily mountable in Linux for review (yes, I'm not talking forensic analysis tools).

mount -o ro,loop /media/USB/<image.dd> /mnt

This command will mount the image read-only and we can do our analysis of the contents. Remember when you are doing a "stat" or "ls" on the file you'll want to use the "-n" option so that it doesn't use the local systems UID mappings and just displays the number associated with that file.

But, what if you have to give that drive to someone so THEY can review the contents? And, what if that person is a Windows-only person? Windows does not have a build in method for mounting raw images let alone understanding EXT3 filesystems. Thus, you have to think "outside-the-box".

cutaway

'''
Name:    bigip_decode_cookie.py
Purpose: Convert BigIP cookies to internal IP address and port number
Date:    20150702
Author:  Don C. Weber (@cutaway) of InGuardians, Inc.

Resources:
    Initial python project I found for doing this: https://penturalabs.wordpress.com/2011/03/29/how-to-decode-big-ip-f5-persistence-cookie-values/
    F5 LTM Encrypted Cookie Insert Persistence: http://packetpushers.net/encrypted-cookie-persistence/
    Encrypting Big-IP Cookies (10.x - 11.x): https://support.f5.com/kb/en-us/solutions/public/14000/700/sol14784.html

cutaway

#!/usr/bin/env python
 
"""
Name:    extract_java_server_faces_viewstate
Purpose: Extract and parse the Java Server Faces viewstate
Date:    20150620
Author:  Don C. Weber (@cutaway) of InGuardians, Inc.

Resources:
    http://wiki.apache.org/myfaces/Secure_Your_Application

cutaway

#!/usr/bin/env python

"""
Name:    cookie_parameters.py
Purpose: An SQLMAP tamper script to handle Cookie GLOBS
Date:    20150612
Author:  Don C. Weber (@cutaway) of InGuardians, Inc.
"""

from lib.core.enums import PRIORITY

cutaway

#!/bin/bash
###########################################################################
# ics_startup.sh - This shell script is designed to help setup Internet
#                       sharing between to interfaces. It will generate
#                       the appropriate iptable rules, implement them,
#                       and start the DHCP server. It will also reset
#                       the system.
# 
# Copyright (c) 2012, InGuardians, Inc. <consulting@inguardians.com>
# 

cutaway

#
# hostapd-wpe.conf
# Brad Antoniewicz (@brad_anton) - Foundstone
# ------------------------------------------------
# Updated to provide additional WPA2 configuration control
# Don C. Weber (@cutaway) - InGuardians, Inc. 
# ------------------------------------------------
#
# Configuration file for hostapd-wpe
#