Blog¶

4/14/24
4 min read

Draft

A couple of months ago, I was invited to join a team to compete in a capture-the-flag event. Having only joined the cybersecurity community a year and a half ago, the invitation was both appreciated and a bit intimidating. Would I be able to contribute something of value? What if I didn't know how to do anything? What if it showed everyone how much I didn't understand?

* screech the brakes *
Curiosity is the antidote to imposter syndrome. When you care more about learning what you need to know than what people think about you, its a game-changer. So armed with my tenacity for learning and the goal of finding out where my strengths might lie in such an event, I accepted the invite.

4/11/24
4 min read

Draft

Flag Swapping for CTF

cyberflag

This was for an exercise I participated in where we thought we would need a way defend our servers against flags from other teams. I created a couple of scripts and then combined them into an iterative script to make it easier to execute once on the box so I wouldn't forget to change specific variables.

3/26/24
7 min read

Fail2Ban Primer

fail2ban

Fail2Ban is a log-parsing application that monitors system logs for symptoms of an automated attack on your server, and it bans offending IPs automatically by updating firewall rules to prevent further breaches. Fail2Ban is configured through jail files located in /etc/fail2ban. It comes with a default configuration file (jail.conf) which should not be edited directly, as it may be overwritten by package upgrades. Instead, create a local copy to override the defaults.

1. Configure Fail2Ban

a. Create a Local Configuration File:

sudo cp /etc/fail2ban/jail.{conf,local}

b. Edit the Local Configuration File:

sudo nano /etc/fail2ban/jail.local

3/26/24
5 min read

Draft

Hardening a Linux Server

hardenLinux

1. Recon First

For a CTF, Grab n Crack

Grab the Hashes for Cracking (swap out the IP)

scp root@server_ip:/etc/passwd ./passwd
scp root@server_ip:/etc/shadow ./shadow

Unshadow

unshadow passwd shadow > combined.txt

Run John

john combined.txt

Review and Note

john --show combined.txt

SSH in and Change Passwords

ssh root@server_ip

passwd username

Document Normal Running Processes

ps aux > processes.txt

OS Info

cat /etc/os-release

2. Least Privilege

Review Current Permissions

Audit the current user accounts, groups, and their permissions on each server.

cat /etc/passwd

or

getent passwd

Checking GUID/SUID files

find / -perm -4000 -type f 2>/dev/null

3/26/24
3 min read

Draft

Hardening a Windows Server

hardenWindows

1. Least Privilege

Review Current Permissions

Audit the current user accounts, groups, and their permissions on each server.

Get-LocalUser

Adjust Permissions

Adjust the permissions so that users and services have only the necessary rights to perform their duties. In Windows, you can manage user permissions through the Local Users and Groups Manager or PowerShell.

Remove or Disable Unnecessary Accounts

Identify accounts that are no longer in use or unnecessary.

Remove User

Remove-LocalUser -Name "ExampleUser"

Disable User

Disable-LocalUser -Name "ExampleUser"

3/25/24
12 min read

Harnessing Wireshark

harnessingwireshark

Background

The ability to effectively analyze network traffic is critical for maintaining security, troubleshooting issues, and optimizing performance. Crafting a tailored Wireshark setup that aligns with specific analysis goals and preferences can significantly enhance efficiency and effectiveness in packet capture analysis. In this post, I'll review some of the basic customization options including display filters, protocol dissectors, and advanced display configurations. These allow users to streamline workflows, focus on pertinent information, and uncover insights that may otherwise remain obscured. In the following walkthrough, we will explore how to set up Wireshark to suit distinct analysis needs.

Downloading Wireshark

Linux

Debian/Ubuntu

sudo apt install wireshark

Fedora

sudo dnf install wireshark

Arch Linux

sudo pacman -S wireshark

GUI Install Option

Wireshark

Windows

Wireshark

macOS

If you don't have Homebrew installed:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Once you've successfully installed Homebrew:

brew install wireshark

GUI Install Option

Wireshark

3/21/24
2 min read

Virtual Environments

venv-chacho Using a virtual environment (venv) in Python creates an isolated spaces for projects. Isolation ensures that each project has its own dependencies, regardless of what dependencies other projects might have.

Why Use venv?

1. Dependency Management

Different projects may require different versions of libraries. Virtual environments allow you to manage these dependencies separately, avoiding conflicts.

2. Project Isolation

By isolating your project environment, you ensure that global package updates or changes in one project do not break or affect other projects.

3/18/24
11 min read

QUIC Protocol

flash-chacho

QUIC (Quick UDP Internet Connections) is a modern transport layer network protocol designed to improve the performance of applications running over the Internet. Developed by Google and standardized by the Internet Engineering Task Force (IETF), QUIC addresses some of the performance and security shortcomings of traditional protocols such as TCP and TLS/SSL. Here's a primer on its key features, benefits, and uses:

Key Features

Multiplexed Connections

Supports multiple streams over a single connection, which helps reduce latency and prevents the "head-of-line blocking" issue that can occur in TCP when packet loss happens.

Built-in Encryption

Incorportes encryption by default with TLS 1.3, ensuring that data is secure from the onset of communication, reducing the number of round trips needed for handshake completion.

Improved Connection Establishment

Aims to reduce connection establishment time. In some cases, it can establish a connection and secure data transfer with zero round-trip time (0-RTT) compared to TCP's 1-RTT plus an additional round-trip for TLS handshake.

Connection Migration

Supports connection mobility, which means it can maintain a connection even if a client's IP address changes, benefiting mobile devices that switch between different networks.

3/16/24
3 min read

PCAP Analysis of the Nitroba Incident

The following is a pcap analysis walkthrough for a course on network traffic analysis. Without the pcap file, this post will not make much sense. The purpose of the post is really just for class amusement. Much like the emails, it will self destruct over the weekend.

johnny

Scenario

Someone connecting to a wifi router in the dorms sent harrassing and threatening emails to a professor. The students who had physical possession of the router allowed a wire tap to be placed on the router to capture traffic after the first message was sent. The task is to analyze the pcap from this after the second message was received to find forensic evidence that may indicate who was responsible for sending the messages.

Export Objects

First, there was quite a bit of traffic to sift through and with the specific transgressions in mind, I decided to first export objects.

HTML > search "www.willselfdestruct.com"
Examined associated packets: 84366. User Agent looked suspicious. Looked at MAC address. MAC address from source indicates Apple computer (does not jive with the UA String).
Note: I later learned that this was not really significant due to where the sniffer was. Nonetheless, the process did not lead me in a wrong direction.

Source MAC:

eth.addr == 00:17:f2:e2:c0:ce

Attacker IP address:

192.168.15.4