shakibamoshiri

How to tunnel SSH over SSL/TLS

laptop ssh -> laptop stunnel -> evil network -> internet -> your server -> your server ssh

Server (your shell server/home box/work box/whatever)

Sets up a stunnel process listening externally on port 2443/tcp, forwards to localhost 22/tcp

• Install stunnel, e.g. yum install stunnel
• Install server config snippet to /etc/stunnel/stunnel.conf

shakibamoshiri

##TCP FLAGS##

Unskilled Attackers Pester Real Security Folks
==============================================
                     TCPDUMP FLAGS
Unskilled =  URG  =  (Not Displayed in Flag Field, Displayed elsewhere) 
Attackers =  ACK  =  (Not Displayed in Flag Field, Displayed elsewhere)
Pester    =  PSH  =  [P] (Push Data)
Real      =  RST  =  [R] (Reset Connection)
Security  =  SYN  =  [S] (Start Connection)

shakibamoshiri

# https://www.percona.com/blog/2008/11/07/poor-mans-query-logging/

tcpdump -i eth0 -s 0 -l -w - dst port 3306 | strings | perl -e '
while(<>) { chomp; next if /^[^ ]+[ ]*$/;
  if(/^(SELECT|UPDATE|DELETE|INSERT|SET|COMMIT|ROLLBACK|CREATE|DROP|ALTER)/i) {
    if (defined $q) { print "$q\n"; }
    $q=$_;
  } else {
    $_ =~ s/^[ \t]+//; $q.=" $_";
  }

shakibamoshiri

# install netctl
sudo pacman -S netctl --noconfirm

# check network card name
ip link

### Config Static IP Address ###
# Card Name : eth0
sudo cp /etc/netctl/examples/ethernet-static /etc/netctl/eth0

shakibamoshiri

OpenVPN and browser specific network routing with ip netns

Create network bridge

A network bridge allows us to have a virtual router that we can plug multiple network interfaces into. The IP address is assigned to the bridge rather than the individual network interface.

Create the bridge device, br0 :

shakibamoshiri

#!/bin/bash

## Create the response FIFO
rm -f response
mkfifo response

function handle_GET_home() {
  RESPONSE=$(cat home.html | \
    sed "s/{{$COOKIE_NAME}}/$COOKIE_VALUE/")
}

shakibamoshiri

ANSI Escape Sequences

Standard escape codes are prefixed with Escape:

• Ctrl-Key: ^[
• Octal: \033
• Unicode: \u001b
• Hexadecimal: \x1B
• Decimal: 27

shakibamoshiri

Wireguard and iptables restrictions for multiple users

If you don't know what Wireguard is, well, you should. It's fast, easy to setup and highly configurable. We will configure Wireguard for multiple users with various restrictions using iptables.

Assumptions

This should fit most setups (not mine though 😉)

shakibamoshiri

# On linux servers
# cd into a temp dir
cd `mktemp -d`

# install it
npm install poshtiban

# test it
./node_modules/poshtiban/bin/run  login --token=YOUR_TOKEN

shakibamoshiri

curl --include \
     --no-buffer \
     --header "Connection: Upgrade" \
     --header "Upgrade: websocket" \
     --header "Host: example.com:80" \
     --header "Origin: http://example.com:80" \
     --header "Sec-WebSocket-Key: SGVsbG8sIHdvcmxkIQ==" \
     --header "Sec-WebSocket-Version: 13" \
     http://example.com:80/