Life with Ubuntu

Installing THC-Hydra 7.0

2011-09-16T15:09:00.000-07:00

THC just released a new version of Hydra (URL http://thc.org/thc-hydra/), a very fast network logon cracker which support many different services (so the website says). I decided to install this on my home laptop. On Ubuntu, you will need to compile the source code provided at URL http://www.thc.org/releases/hydra-7.0-src.tar.gz

I proceeded to untar the source code and when I did the ./configure command, a list of libraries that Hydra requires was missing from my laptop. I only managed to install some of the libraries with the command:

sudo apt-fast install libpq-dev libsvn-dev libssh-dev

However, when I ran the ./configure command again, not all libraries were installed (I couldn't' figure out which ones they wanted). The output I got after the second ./configure was:

Starting hydra auto configuration ...
Detected 32 Bit Linux OS

Checking for openssl (libssl, libcrypto, ssl.h, sha.h) ...
... found
Checking for idn (libidn.so) ...
... NOT found, unicode logins and passwords will not be supported
Checking for pcre (libpcre.so, pcre.h) ...
... found
Checking for Postgres (libpq.so, libpq-fe.h) ...
... found
Checking for SVN (libsvn_client-1 libapr-1.so libaprutil-1.so) ...
... found
Checking for firebird (libfbclient.so) ...
... NOT found, module firebird disabled
Checking for MYSQL client (libmysqlclient.so, math.h) ...
... found
Checking for AFP (libafpclient.so) ...
... NOT found, module Apple Filing Protocol disabled - Apple sucks anyway
Checking for NCP (libncp.so / nwcalls.h) ...
... found
Checking for SAP/R3 (librfc/saprfc.h) ...
... NOT found, module sapr3 disabled
Get it from http://www.sap.com/solutions/netweaver/linux/eval/index.asp
Checking for libssh (libssh/libssh.h) ...
... found
Checking for Oracle (libocci.so libclntsh.so / oci.h) ...
... NOT found, module Oracle disabled
Checking for GUI req's (pkg-config, gtk+-2.0) ...
... found

Hydra will be installed into .../bin of: /usr/local
(change this by running ./configure --prefix=path)

Writing Makefile.in ...
now type "make"

I then proceeded to issue the make && sudo make install command to compile and install the program.

The program seems to work and I hope somebody out there reading this can help me with the missing "NOT found, module..." errors.

This blog is so dead (not!)...

2011-01-08T11:56:00.000-08:00

I know I have been rather quiet with my "Life with Ubuntu" blog. Work has gotten the better part of me and what little time I have now is usually me messing about on my linux based Nokia N900.

My last post mentioned that was going to test Ubuntu 10.10 but looking at all the changes Canonical has been doing, I think I will stick to my Ubuntu 10.04 LTS build until something compels me to upgrade (perhaps to the next LTS version).

There are a few article I plan to post in this blog, but it will tie in with another blog I've created called Life with Maemo which is about my Nokia N900 computer (with phone functionality) running the Maemo 5 operating system (which itself is an ARM based Debian linux "ecosystem").

Ohh! a belated Merry Christmas and a (belated!) Happy New Year!

What I've been up to...

2010-10-20T10:22:00.000-07:00

In case you didn't know, Ubuntu 10.10 was released on 10.10.10. I've not upgraded my systems as I am quite happy with 10.04 and the promise of it's LTS (Long Term Support). That said, I'll pick one of my machines and see how good 10.10 is and post my findings at a later date.

What have I been up to lately? My friend (droll) introduced me to a nifty little device called the Nokia N900 which is based of Maemo which is derived from Debian Linux.

I've gotten a nifty overclocking which allows my to underclock the device at 125MHz all the way to 1.15GHz (the stock speeds at 250MHz till 600MHz). I've also gotten kismet and nmap installed on this device so wireless testing is now simply putting my phone in my pocket and walking around. I will soon be trying to get install OpenVAS which should make for a rather complete basic pentesting setup, all on my phone. I may even try Ubuntu 9.04 which somebody ported over to the N900 (it's ARM based).

Though this site is called "Life with Ubuntu", I guess I'll be including some Maemo/MeeGo blogs in the future.

News of interest for the month of July 2010...

2010-07-31T18:47:00.000-07:00

inundator v0.5 Released – IDS/IPS/WAF Evasion & Flooding Tool

inundator is a multi-threaded, queue-driven, IDS evasion tool. Its purpose is to anonymously flood intrusion detection systems (specifically Snort) with traffic designed to trigger false positives via a SOCKS proxy in order to obfuscate a real attack.

http://inundator.sourceforge.net/

Safe3 SQL Injector – Automatic Detection & Exploitation Of SQL Injection Flaws

Safe3 SQL Injector is one of the most powerful penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of back-end database servers.

http://code.google.com/p/safe3si/

REMnux: A Linux Distribution For Reverse-Engineering Malware

REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. The distribution is based on Ubuntu and is maintained by Lenny Zeltser.

http://zeltser.com/remnux/

Andiparos – Open Source Web Application Security Assessment Tool

Andiparos is a fork of the famous Paros Proxy. It is an open source web application security assessment tool that gives penetration testers the ability to spider websites, analyze content, intercept and modify requests, etc.

http://code.google.com/p/andiparos/

Metasploit Framework 3.4.1 Released – 16 New Exploits, 22 Modules & 11 Meterpreter Scripts

The Metasploit Project is proud to announce the release of the Metasploit Framework version 3.4.1. This release sees the first official non-Windows Meterpreter payload, in PHP.

http://www.metasploit.com/

thc-ipv6 Toolkit – Attacking the IPV6 Protocol

A complete tool set to attack the inherent protocol weaknesses of IPV6 and ICMP6, and includes an easy to use packet factory library. Please note to get full access to all the available tools you need to develop IPV6 tools yourself or submit patches, tools and feedback to the thc-ipv6 project.

http://thc.org/thc-ipv6/

Sagan – Real-time System & Event Log (syslog) Monitoring System

Sagan is a multi-threaded, real time system- and event-log monitoring system, but with a twist. Sagan uses a “Snort” like rule set for detecting “bad things” happening on your network and/or computer systems. If Sagan detects a “bad thing” happening, that event can be stored to a Snort database (MySQL/PostgreSQL) and Sagan will correlate the event with your Snort Intrusion Detection/Intrusion Prevention (IDS/IPS) system. Sagan is meant to be used in a ‘centralized’ logging environment, but will work fine as part of a standalone Host IDS system for workstations.

http://sagan.softwink.com/

PlainSight – Open Source Computer Forensics LiveCD

PlainSight is a versatile computer forensics environment that allows inexperienced forensic practitioners perform common tasks using powerful open source tools such as RegRipper, Pasco, Mork, Foremost and many more.

http://www.plainsight.info/

WPA2 Vulnerability Discovered – “Hole 196″ – A Flaw In GTK (Group Temporal Key)

Malicious insiders can exploit the vulnerability, named “Hole 196″ by the researcher who discovered it at wireless security company AirTight Networks. The moniker refers to the page of the IEEE 802.11 Standard (Revision, 2007) on which the vulnerability is buried. Hole 196 lends itself to man-in-the-middle-style exploits, whereby an internal, authorized Wi-Fi user can decrypt, over the air, the private data of others, inject malicious traffic into the network and compromise other authorized devices using open source software, according to AirTight.

http://www.networkworld.com/newsletters/wireless/2010/072610wireless1.html

iKAT – Interactive Kiosk Attack Tool v3

iKAT was designed to aid security consultants with the task of auditing the security of a Windows based internet Kiosk terminal. iKAT is designed to provide access to the underlying operating system of a Kiosk terminal by invoking native OS functionality. This tool should be (and is) used by Kiosk vendors/developers/suppliers to test the security of their own Kiosk products.

http://ikat.ha.cked.net/

Knock v1.4.2b – Subdomain Enumeration/Brute-Forcing Tool

Knock is a python script designed to enumerate sub-domains on a target domain through a wordlist.

http://knock.gianniamato.it/download.php

Websecurify 0.7RC1 - powerful web application security testing

Websecurify is a powerful web application security testing environment designed from the ground up to provide the best combination of automatic and manual vulnerability testing technologies.

http://code.google.com/p/websecurify/

News of interest for the month of June 2010...

2010-06-26T23:02:00.000-07:00

Websecurify 0.6 - powerful web application security testing

Websecurify is a powerful web application security testing environment designed from the ground up to provide the best combination of automatic and manual vulnerability testing technologies.

http://code.google.com/p/websecurify/

w3af 1.0-rc3 Available For Download – Web Application Attack & Audit Framework

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.

http://w3af.sourceforge.net/

OpenSCAP – Framework For Implementing SCAP (Security Content Automation Protocol)

The OpenSCAP Project was created to provide an open-source framework to the community which enables integration with the Security Content Automation Protocol (SCAP) suite of standards and capabilities. It is the goal of OpenSCAP to provide a simple, easy to use set of interfaces to serve as the framework for community use of SCAP.

http://www.open-scap.org/page/Main_Page

Onapsis Bizploit – ERP Penetration Testing Framework

Bizploit is the first Opensource ERP Penetration Testing framework. Developed by the Onapsis Research Labs, Bizploit assists security professionals in the discovery, exploration, vulnerability assessment and exploitation phases of specialized ERP Penetration Tests.

http://www.onapsis.com/research.html#bizploit

Samurai Web Testing Framework v0.8 Released – Pen Testing Security LiveCD

The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites.

http://samurai.inguardians.com/

Knock v1.3b – Subdomain Enumeration/Brute-Forcing Tool

Knock is a python script designed to enumerate sub-domains on a target domain through a wordlist.

http://knock.gianniamato.it/download.php

sectool – Security Audit Tool and IDS

sectool is a security tool that can be used both as a security audit as well as a part of an intrusion detection system. It consists of set of tests, library and textual/graphical frontend. Tests are sorted into groups and security levels. Administrators can run selected tests, groups or whole security levels.

https://fedorahosted.org/sectool/

Anti-virus revisited...

2010-06-21T11:39:00.000-07:00

I remember writing a short post (read here) about why Ubuntu users don't need an anti-virus. However, over the past few months, my opinion on this has changed.

For starters, linux (unix in general) is more secure by design unless you are the village idiot who insist on logging into your Ubuntu setup as root (you actually need to hack this as Ubuntu by default prevents users from logging is as the root user). What few viruses/worms that do exist can only affect the user as per his/her access rights to the system.

However (I did say I've changed my opinion on this), Ubuntu users do receive a lot of files from other users who (gasp!) use Windoze (and Macs) and these platforms do have viruses/worms. What we do not want to be is a carrier for those malware. So installing an anti-virus should be done only for the occasional health scan and to maybe scan new files as you get them.

I have Googled around for a decent, free, linux based anti-virus and have found the following:

ClamAV (URL http://www.clamav.net/lang/en/) or check with Synaptics
avast! (URL http://www.avast.com/linux-home-edition)
AVG (URL http://free.avg.com/gb-en/download.prd-afl)
F-Prot (URL http://www.f-prot.com/products/home_use/linux/)

I ended up using AVG for myself since it was a CLI only installer (yes, no GUI) and didn't require me to register to use it (as you can see, I only tested one product). In any case, if you want to give it a try, these are the free ones I could find. Feel free to let me know what you think of this post or the product if you tried them.

You can also check the Ubuntu page on anti-viruses here.

Eee-control is still alive!

2010-06-15T02:27:00.000-07:00

Grigori Goronzy, the developer of eee-control has just release version 0.9.6 of the utility for Lucid Lynx (URL http://greg.geekmind.org/eee-control/). I strongly suggest all Asus EeePC users install this fantastic utility into their Ubuntu setups. Will test this myself when I get home. :)

Installing Sun/Oracle Java 6 Update 20 in Lucid...

2010-05-21T12:46:00.000-07:00

Since Ubuntu 9.10 (Karmic Koala), Canonical has dropped support of Sun Java on Ubuntu. However, I noticed that Canonical has slowly reintroduced Sun Java to Ubuntu by placing the .deb installers into the Ubuntu 'partner' repository. To install, type in the following:

sudo add-apt-repository “deb http://archive.canonical.com/ lucid partner”

This will add the associated Ubuntu repository to your Ubuntu. Next, you'll want to install Java 6 Update 20, this can be done by:

sudo apt-get install sun-java6-jre sun-java6-plugin sun-java6-fonts

You will now have a proper version of Java in your Ubuntu setup.

Upgraded my laptop to Lucid Lynx...

2010-05-16T09:56:00.000-07:00

I finally upgraded my laptop from Karmic -> Lucid today. If you've read my last post here about my initial reservations on upgrading to Lucid and how I checked if my laptop was affected by booting up the Lucid live CD, I am happy to report that I successfully upgraded to Lucid. The only problem I had after the upgrade was Plymouth not showing me the startup animation.

First thing I did was install the ppa-purge utility (see my blog post here). I then systematically checked the entries in /etc/apt/source.list and all the .list files in /etc/apt/source.list.d and purged all the PPA (Personal Package Archives) I was using and replacing them with official Karmic versions from the Ubuntu repository.

I then downloaded the ubuntu-10.04-alternate-i386.iso file from one of Ubuntu's mirror sites and following the instructions here, upgraded my setup to Ubuntu 10.04 (Lucid Lynx).

I rebooted the computer and did another update (since there are updates to some of the packages since the release on 29-Apr-2010) in a terminal shell by typing:

sudo apt-get update && sudo apt-get upgrade -y

Everything worked correctly as expected except by Plymouth. A quick Google search landed me here and my setup works exactly as expected.

I am now a happy ~~lemming~~ lynx. :)

Upgrading problems for Intel Graphic owners to Ubuntu 10.04 Lucid Lynx...

2010-05-12T21:03:00.000-07:00

I am usually one of the first few people to upgrade my Ubuntu installation every time Canonical releases a new build of Ubuntu. However, I had noticed a few users having problems with their upgrades and decided to "wait and see".

There are now quite a few users reporting that Intel Graphic owners have problems with the KMS (Kernel Mode Switch) with the new kernels. I strongly suggest owners to wait until this problem is resolved and stick with Karmic Koala until then. You can find out more about this issue at the ubuntuforums.org site with a Google query here.

I've read some websites saying that there is a quick fix to the problem where the kernel switches off KMS on known problematic graphic chipsets. Though this makes it easier to move from Karmic to Lucid, I'm personally going to wait until the problem is fixed (fixed with functionality, not fixed by switching the function off on problem machines). You can read about this workaround here.

Upgrading from Karmic Koala to Lucid Lynx...

2010-05-01T00:41:00.000-07:00

Now that Ubuntu 10.04 (Lucid Lynx) is out, I am sure most users will want to upgrade their Ubuntu 9.10 (Karmic Koala) to the new and improved. My advise to new users or those unfamiliar with the terminal bash shell to wait for other more experienced users to upgrade and see if they encounter any problems. If they have a similar setup or hardware as you have, then read or wait till the problem is solved. You can quickly check how by using Google and doing a query like this.

For the power users and those familiar with the workings of Ubuntu, you most probably also use a lot of PPAs (Personal Package Archives) either from Launchpad or some other repository. In case you didn't know, upgrading your Karmic to Lucid will result in:

The upgrade will disable all non-Ubuntu repositories from your source.list file or source.list.d folder.
The applications/packages that you have already installed may not work correctly, break, and/or damage your setup after the upgrade due to architecture differences or dependencies.

The easiest way for a Karmic user to ensure that their upgrade to Lynx is successful, is to first make a backup copy of their source.list file and sources.list.d folder. Then remove all software installed by the PPA and reinstall the same software from the Ubuntu repositories.

This used to be quite a laborious task as this was usually done manually. Now, you can use a program called ppa-purge which you can get for Karmic only here. Once you have installed this, simply type:

ppa-purge ppa:ubuntu-mozilla-daily/ppa

Replace "ppa:ubuntu-mozilla-daily/ppa" with the PPAs that you use. This will remove the installed applications from the said repository, remove the repository reference from Ubuntu and then reinstall the official supported version of the same application from Ubuntu's repository.

Once you have cleaned up all your PPAs, you can safely upgrade to Lucid Lynx. Once there, you can simply enable your favorite PPAs from your source.list and source.list.d folder and replace the keyword karmic with lucid. Before doing so, I strongly suggest you visit each developer's PPA page to see if they have a better version of the same software that the Ubuntu repositories has before upgrading to the PPA version.

I am not giving detailed steps for this post as this post is meant for power users who should know what I am talking about.

Ubuntu 10.04 Lucid Lynx is now available...

2010-05-01T00:29:00.000-07:00

Ubuntu 10.04 (Lucid Lynx) LTS (Long Term Support) is now available. I know I may seem to be two days late with this news, but on the eve of release, a critical bug (bug #570765) was found in the final build. This resulted in the Ubuntu team having to fix the bug, re-test and rebuild the ISO images.

Anyway, the bug has been fixed and 10.04 is now ready for the masses. Go get your copy here. If you have a very slow internet connection or need to install/upgrade Ubuntu at a location that is without internet access, you can order a copy of 10.04 disc (it's free) from here.

Nessus 4.2.2 released today...

2010-04-15T23:54:00.000-07:00

Took the below from an email I got today.

----------------------------------------------

Nessus 4.2.2 has been released today. This release contains the following fixes:

Nessus-fetch:

- Proxy issues have been resolved

NASL:

- Fixed a memory leak in the NASL xmlparse() function

Networking:

- Fixed IPv6 routing when talking to a remote host (FreeBSD, Mac OS X)

- Packet forgery was not always working on ES5 64 bits

Packaging:

- Fixed the Debian /etc/rc init script

- Upgraded OpenSSL to version 0.9.8n (Windows, Solaris)

Stability:

- Fixed a possible crash when using a badly written custom plugin

- Fixed a possible crash when running out of BPFs on Windows

Installing OpenVAS 3.0.x on Ubuntu Linux...

2010-04-11T07:54:00.000-07:00

This is a follow-up to my earlier article on Installing OpenVAS 2.0.x on Ubuntu Linux...

Updating your Ubuntu Setup

Before we begin, it is best that we update our Ubuntu libraries and applications to the latest versions by typing the following in a terminal:

sudo apt-get update
sudo apt-get upgrade

Installing the libraries that OpenVAS uses

Once you have updated your machine, we will need to install the following libraries and applications to compile and install OpenVAS. Again, in the terminal:

sudo apt-get install cmake build-essential libgtk2.0-dev libglib2.0-dev libssl-dev htmldoc libgnutls-dev libpcap0.8-dev bison libgpgme11-dev libsmbclient-dev snmp pnscan

Downloading the source code and compiling them

Now that the machine is ready to work with the OpenVAS sources, you then need to download the following source codes from the OpenVAS website. You can find the sources at URL http://wald.intevation.org/frs/?group_id=29

Download the latest version of the following:

openvas-libraries (latest v3.0.x, I used 3.0.4)
openvas-scanner (latest v3.0.x, I used 3.0.2)
openvas-client (latest v3.0.x, I used 3.0.0)

You will need to install OpenVAS in the above listed order. To install each component, you will need to do the following:

tar -zxvf [filename of .tar.gz file]
cd [sub-folder of same name as .tar.gz file]
./configure
make
sudo make install
cd ..

If you are using the 64-bit version of Ubuntu, you may get an error message ("/usr/bin/ld: cannot find -lcrypto") when you 'make' the openvas-client. You can fix this by typing:

sudo ln -s /usr/lib/libcrypto.so.0.9.8 /usr/lib/libcrypto.so

Once all three components are compiled and installed, you will then need to let Ubuntu know about the new libraries you have just compiled before the can be used by typing in:

sudo ldconfig -v

First time OpenVAS users

For the first time use of OpenVAS, you will need to create a new cert and add in the first user that can login into the OpenVAS server by running both:

sudo openvas-mkcert
sudo openvas-adduser

Updating the latest plug-ins

Periodically (I usually run it once every day, or just before I am about to use OpenVAS), you will need to update the plugins that OpenVAS uses to detect newer vulnerabilities which are found everyday. You can do that by typing:

sudo openvas-nvt-sync

Note: There is a bug in the update script and you will get an error message (as of today, 11-Apr-2010). A quick look at the OpenVAS forums showed a typo made by one of the developers and the way to fix this is do the following (in a terminal):

gksu gedit /usr/local/sbin/openvas-nvt-sync

Search for the string (my script had it on line 63):

SYNC_TMP_DIR='mktemp -d openvas-nvt-sync'

and change it to:

SYNC_TMP_DIR='mktemp -d openvas-nvt-sync.XXXXXXXXXX -t'

To start the OpenVAS server, activate the server by typing in:

sudo openvassd

And running the OpenVAS client by typing:

sudo OpenVAS-Client

If you want to learn or know more about OpenVAS, visit them at http://www.openvas.org/

Note: Tested on Ubuntu 9.10, and I assume you are doing all this with user access (that is why, some root only commands have the "sudo" command in front of them) and am running the kernel in i386 (32-bit) mode. Also, as I did not test this on a 64-bit system, the 64-bit only error/solution mentioned in my article comes from the forums and I have not tested them myself.

Installing Firefox 3.6 into Ubuntu 9.10 (Karmic)

2010-03-13T07:30:00.000-08:00

If you are like me and constantly want the latest version of everything in your Ubuntu installation, you will most probably want to install Firefox 3.6 into your Ubuntu installation. You first have the add in the Mozilla Team's firefox-stable repository by typing the following in a terminal shell:

sudo add-apt-repository ppa:mozillateam/firefox-stable

Once you have that entry in your source.list file, you will need to update the available installers with the command:

sudo apt-get update

Now you can simply get firefox 3.6 installed with the command:

sudo apt-get install firefox-3.6

Warning, this will remove your current installation of Firefox.

:::::::::::: For older Ubuntu users :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

If you are a Jaunty, Intrepid or Hardy user, you will need to edit the source.list file by typing the following into the terminal shell:

gksudo gedit /etc/apt/sources.list

You then need to add in the following two lines at the end of the file:

deb http://ppa.launchpad.net/mozillateam/firefox-stable/ubuntu BUILDNAME main
deb-src http://ppa.launchpad.net/mozillateam/firefox-stable/ubuntu BUILDNAME main

Remember to replace the name BUILDNAME, with jaunty, intrepid or hardy (depending on which version of Ubuntu you have installed).

You will then need to import the correct public key so that Ubuntu will trust the repository. To do that, please read my earlier post on Getting the public key of a Ubuntu repository.

Again, once you have done the above, you will need to issue the command for Ubuntu to update and install the repository data and install Firefox 3.6:

sudo apt-get update
sudo apt-get install firefox-3.6

You now have Firefox 3.6 installed. :)

Securing your Apache 2 web server...

2010-01-12T08:57:00.000-08:00

I have done a lot of server security testing and one of the most common mistakes I see in most web server implementation of customer's web server is:

1. The server banner of the web server displays the product and version number of the seb server application.

2. The web server has the debug command TRACE enabled by default in the production environment.

When you install Apache 2 in a Ubuntu box (may be similar for other Linux distros), the above two options are by default enabled.

The easiest way to remove TRACE and obfuscate the server banner version is to add the following commands into apache2.conf found in the /etc/apache2/ folder. They are:

ServerTokens ProductOnly
ServerSignature Off
TraceEnable Off

The commands are self explainatory and you really should google for them...

Goodbye 2009, Hello 2010...

2009-12-31T06:26:00.001-08:00

Today is the last day of 2009, and I welcome 2010 with open arms...

I hope my blog the past year has made people more interested in Linux (especially Ubuntu) and/or computer security. I am looking forward to hearing from you... especially if you find my postings useful.

END!

Installing Websecurify 0.4...

2009-11-23T22:11:00.000-08:00

Websecurify is a web application testing tool developed by Petko Petkov that automatically identifies web application vulnerabilities by using advanced discovery and fuzzing technologies. To know more about Websecurify, click on the link here.

For Ubuntu 8.10 (or older) users (others can skip to the Websecurify Installation section below)

Before installing Websecurify on your Ubuntu system, you will need to have xulrunner v1.9.1 (or higher) installed. Since your installation of Ubuntu has an older version of xulrunner, you will need to update your system to meet this pre-requisite. The easiest way to do this is by installing Firefox 3.5 which come with the required version xulrunner.

The easiest/safest way to do this is to go to the "ubuntu-mozilla-daily" PPA archive at URL:

https://launchpad.net/~ubuntu-mozilla-daily/+archive/ppa

Follow the instruction there to get your version of Ubuntu installed with the correct repository that holds the version on firefox 3.5 compatible with your Ubuntu installation. Remember to also install the public key to you don't get prompted with security warnings when trying to use the repository.

Then, we update the machine's repository database with:

sudo apt-get update
sudo apt-get upgrade

To install Firefox 3.5 (warning, this will replace older versions of firefox in your Ubuntu machine):

sudo apt-get install firefox-3.5

Websecurify Installation

Download the Linux version at URL http://websecurify.googlecode.com/files/Websecurify%200.4.tgz (download the file to your Desktop)

Create a folder to store the websecurify application:

mkdir ~/websecurify-0.4

Go into the folder you just created:

cd ~/websecurify-0.4

Extract the archive:

tar -zxvvf ~/Desktop/Websecurify\ 0.4.tgz

To install the application, type:

xulrunner --install-app application.ini

To launch Websecurify, type:

xulrunner --app application.ini

Note: For Ubuntu 8.10 (or older) users, you must type in xulrunner-1.9.1 instead of xulrunner to install and to launch Websecurify.

Installing OpenVAS 2.0.x on Ubuntu Linux...

2009-11-18T19:45:00.000-08:00

This is a follow-up to my earlier article on Installing OpenVAS 1.0.x

OpenVAS has started releasing betas of v3.0.x, so I thought I'd write a tutorial on how to install the latest stable version of OpenVAS (v2.0.x).

Before we begin, it is best that we update our Ubuntu libraries and applications to the latest versions by typing the following in a terminal:

sudo apt-get update
sudo apt-get upgrade

Once you have updated your machine, we will need to install the following libraries and applications to compile and install OpenVAS. Again, in the terminal:

sudo apt-get install build-essential libgnutls-dev libpcap0.8-dev bison
sudo apt-get install libgtk2.0-dev libglib2.0-dev libgpgme11-dev libssl-dev htmldoc

Now that the machine is ready to work with the OpenVAS sources, you then need to download the following source codes from the OpenVAS website. You can find the sources at URL http://wald.intevation.org/frs/?group_id=29

Download the latest version of the following:

openvas-libraries (latest v2.0.x)
openvas-libnasl (latest v2.0.x)
openvas-server (latest v2.0.x)
openvas-plugins (latest v1.0.x)
openvas-client (latest v2.0.x)

You will need to install OpenVAS in the above listed order. To install each component, you will need to do the following:

tar zxvf [filename of .tar.gz file]
cd [sub-folder of same name as .tar.gz file]
./configure
make
sudo make install
cd ..

Once all five components are compiled and installed, you will then need to let Ubuntu know about the new libraries you have just compiled before the can be used by typing in:

sudo ldconfig -v

For the first time use of OpenVAS, you will need to create a new cert and add in the first user that can login into the OpenVAS server by running both:

sudo openvas-mkcert
sudo openvas-adduser

Periodically (I usually run it once every day, or just before I am about to use OpenVAS), you will need to update the plugins that OpenVAS uses to detect newer vulnerabilities which are found everyday. You can do that by typing:

sudo openvas-nvt-sync

To start the OpenVAS server, activate the server by typing in:

sudo openvasd -D

And running the OpenVAS client by typing:

sudo OpenVAS-Client

If you want to learn or know more about OpenVAS, visit them at http://www.openvas.org/

Note: Tested on Ubuntu 9.10, and I assume you are doing all this with user access (that is why, some root only commands have the "sudo" command in front of them) and am running the kernel in i386 (32-bit) mode.

Metasploit 3.3 is now available!

2009-11-18T06:41:00.000-08:00

The guys at Metasploit have release Metasploit Framework 3.3. To install this in Ubuntu, please follow the instructions from their wiki page.

eee-control for Ubuntu 9.10 (Karmic Koala)

2009-11-12T02:51:00.000-08:00

I have been waiting patiently for Grigori Goronzy, the developer of eee-control to release a version of the utility for Karmic Koala (URL http://greg.geekmind.org/eee-control/). However, three weeks since Karmic was released, Grigori has yet to release an update.

Dan Amlund has downloaded the latest version Grigori released for Jaunty Jackalope (0.9.4) and fixed it so that it will install on Karmic Koala. I have installed iton my EeePC 701 and everything seems to be working (your mileage may vary).

To get Dan's version of eee-control which works on Karmic Koala,visit Ubuntu Geek's article at URL http://www.ubuntugeek.com/howto-install-eee-control-in-ubuntu-9-10-karmic.html

The ever important /tmp folder...

2009-09-12T03:22:00.000-07:00

I was busy trying to see if I could speed up Adobe's flash which crawls on Linux systems, yet on the same computer running Windows XP, the same flash application runs much faster. I Googled the net and tried the recommendations other users had posted. I tried one of those recommendations and noticed that the application started quick enough but over time, slowed down to a crawl. Even if I reload that web page, the application still crawled.

What did I do? I said to myself, maybe if I deleted the /tmp folder, the flash application would reload and work like normal. I then started the command shell and typed:

sudo rm -r /tmp

Thinking that if anything goes wrong, just restart Ubuntu and it should recreate the /tmp folder since I've came to an understanding that Linux will delete all files in the /tmp folder at startup anyway. Once I deleted the folder, I didn't get the results I was expecting and said to myself that I best restart my computer.

Computer restarts and loads up in about 30 seconds (Jaunty does that on my Pentium M 1.73GHz computer). I then give my login credentials but get an error message saying "mkdtemp: private socket dir: Permission denied".

I Googled the error message (from another computer) and it turns out that if you delete the /tmp folder, Ubuntu will recreate the /tmp folder but with the wrong permission settings!

How did I solved this? I restarted Ubuntu in recovery mode, then issued the command:

sudo chmod a+w /tmp

Restarted Ubuntu and problem solved. Now you know how to DoS your own machine and fix it. :)

Create a .deb package from source files

2009-08-25T11:51:00.000-07:00

If you are like me, you will find that you need to install a lot of application software from the source code and compile the build for your specific platform. The most common way of installing the program is to download the source (usually it's a file with .tgz or .tar.gz extension to it), unpack the file, go into the directory where the source files are extracted, run the configure tool, followed by the make and finally the make install commands.

wget http://site.com/source/program-1.0.tgz
tar -zxvf program-1.0.tgz
cd program-1.0
./configure
make
sudo make install

This will download, extract, compile and install the program in your Ubuntu eco-system.

If you have to do this to a few machines or need to reinstall your computer ever so often, it would simply be easier if you could create a .deb file and simply install the program when you need to which is faster, and you do not need the installation of compiler, make utility, header and dev libraries.

There is a tool called checkinstall which you can install from the Ubuntu repository. To do that, simply run the command:

sudo apt-get install checkinstall

Once that is installed, when you want to create a .deb file, you do pretty much everything like normal but instead of installing the program with "sudo make install", you create a .deb at this point with the command "sudo checkinstall" which will create the .deb file for you.

You can then copy the .deb file into a safe place, and when you need to install in the future, copy the .deb file to your local directory and issue the command "sudo dpkg -i package.deb" which will install the applictaion for you without the need for the source download, dev libraries, compiler, etc.

Note: These are basic instructions that may not always work. Some packages require additional dependencies and optional parameters to be specified in order to build them successfully.

Using BackTrack 4 applications on a Ubuntu (8.10 Intrepid) build...

2009-07-08T22:30:00.000-07:00

There is a security tools distro called BackTrack which in it's own words:

BackTrack is the most top rated linux live distribution focused on penetration testing. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes.

To know more about BackTrack, click here.

The latest version of BackTrack (BackTrack 4) does away with a simple build that is only good for the next six months (you could never really update the build completely). It now uses Ubuntu (8.10 Intrepid) as a base so that application and updates are easily available and updated.

As much as I like BackTrack which uses KDE, I am a GNOME person. Instead of using the BackTrack build, I wanted to use Ubuntu, yet leveraging on the vast amount of tools that BackTrack offers. To do that, you must add the following into your /etc/apt/sources.list file:

deb http://repo.offensive-security.com/dist/bt4 binary/

Before you can start using the BackTrack repository, you will need to install the GPG key so that the APT tool does not give you an error message saying the repository has no public key. To do that:

wget http://apt.pearsoncomputing.net/public.gpg
sudo apt-key add public.gpg

You can then issue the apt-get update command and download the list of application that the repository hosts and use the Synaptic Package Manager to view what is available and install the applications that you want.

Note, you should only do this on Ubuntu 8.10 Intrepid as all the work the BackTrack team does is using this version of Ubuntu. I am assuming you are well versed in the ways of Ubuntu and know when you need to use root access to do some of the actions stated in this article.

Speeding up your Ubuntu updates -- Malaysian update

2009-07-06T00:09:00.000-07:00

I had posted an article called Speeding up your Ubuntu updates on 7-Mar-2009. What I had failed to realise was the fact that Ubuntu updates are now hosted on a Malaysian site at the Multimedia University at archive.mmu.edu.my since 21-Jun-2008.

Jaunty users will see the Malaysian host when they run the Software Sources program in Ubuntu. Earlier distros will need to manually change the source in /etc/apt/source.list file. Go to this link for more details.

Keeping yourself updated (really useful links) - 20090530...

2009-05-30T00:33:00.000-07:00

I have found that no one person or website can keep track of security issues. Below are the addresses of some sites that I visit or subscribe to to keep me updated.

Nice Linux Easter Eggs

2009-04-28T00:53:00.000-07:00

TuxArena posted some Easter Eggs found in Ubuntu, have a read... fun!

Misc info...

2009-04-26T21:04:00.000-07:00

Tenable has released Nessus 4, you can go give it a try at http://www.nessus.org/nessus/.

I have upgraded all my machines (except my EeePC) to Ubuntu 9.04 Jaunty Jackalope. So anything I post from now onwards is most probably done on a Jaunty build and maybe an Intrepid (my EeePC).

In case anyone is wondering, I have successfully upgraded my wubi installation of Ubuntu from 8.10 to 9.04.

Installing Metasploit 3.2 on Ubuntu 9.04...

2009-04-11T10:44:00.000-07:00

If you want to use Metasploit, you will need to install this program manually as it is not found in Ubuntu's repository (feel free to correct me on this).

You will first need to install the following libraries from Ubuntu's repositories:

sudo apt-get install subversion ruby libruby rdoc libyaml-ruby libzlib-ruby
sudo apt-get install libopenssl-ruby libdl-ruby libreadline-ruby
sudo apt-get install libiconv-ruby rubygems libgtk2-ruby libglade2-ruby

You will then need to download Metasploit 3.2 from the Metasploit website at URL:

http://spool.metasploit.com/releases/framework-3.2.tar.gz

The easiest way would be to use the wget command:

wget "http://spool.metasploit.com/releases/framework-3.2.tar.gz"

Unpack the program:

tar -zxvf framework-3.2.tar.gz

You will then need to update Metasploit with the latest exploits and updates by going into the framework-3.2 sub-directory and issuing the subversion update command:

sudo svn update

You now have the latest version of Metasploit. It is recommended that you issue the "sudo svn update" command every time you are about to use the program or at least once a week.

Tested this on Ubuntu 9.04 (Jaunty Jackalope) beta...

Installing Chromium Browser in Ubuntu

2009-03-17T02:46:00.000-07:00

The people in launchpad.net are building early builds of the Chromium browser (this is not Google's Chrome browser) for Ubuntu with daily builds released. Take note that this is still early-alpha builds, but will give you a glimpse of what is to come. For instructions, go to:

https://launchpad.net/~chromium-daily/+archive/ppa

Speeding up your Ubuntu updates

2009-03-07T01:58:00.000-08:00

This is so essential, I wonder why I didn't mention this earlier.

Now, I am sure most Ubuntu users when they first install Ubuntu on their computer, will usually (as part of the installation process) tell the Ubuntu installer where they are located and the timezone they are at. The installer then tries to point your Ubuntu installation to the nearest repository so that you can download all the latest patches and updates via this point instead of the main Ubuntu servers.

I am located in Malaysia, so the installer places me on the Malaysian server which is located at my.archive.ubuntu.com. Now, the problem with the internet is, routing is never an exact science and the Malaysian server at my.archive.ubuntu.com is actually located in the United Kingdom and it shows when I run an update and usually get around 20kb/s download transfers.

I have two choices to try and speed up my updates. The first thing you need to do is to run a program called "Software Sources" found at:

System -> Administration -> Software Sources

In this program, under the "Download from:" option, you can select the "Other..." option and a list of servers that mirrors the main Ubuntu server are listed. You can simply select a server in your country or if your country is not listed, a near or neighboring country from the list as your source of Ubuntu updates. This is your first option, which usually works quite well and you will notice a faster then before download rate.

The second and preferred option is to click the "Select Best Server" button which will ping all the servers on the list and automatically select for you the server with the faster response time. This option usually points you to the server that will give you the fastest download rates.

I am now pointed to a server in Taiwan which gives me a very high download rate (about 150kb/s) and quite strangely, without the "Select Best Server" button, I would have chosen a server in Singapore or Thailand due to the close proximity of the two countries to Malaysia.

Do give this a try and let me know if this article was useful.

Opening Microsoft Compressed HTML Help (.chm) files

2009-02-14T13:03:00.000-08:00

I have a few e-books formatted in Microsoft's Compress HTML Help format. To open these files, I had to install a viewer called xchm. To install it in Ubuntu, I opened a terminal shell and typed:

sudo apt-get install xchm

However, the installer did not associate .chm files with the xchm program in GNOME. To fix this, I right-clicked on a .chm file and selected "Properties". I then selected the "Open with" tab and chose xchm from the list of applications.

What anti-virus?

2009-02-13T15:47:00.000-08:00

One cool thing about being a Ubuntu user the last four years is the fact that I do not need to install an anti-virus program into my computer. This only goes to show that linux is superior in design to Windoze. This saves me money (don't need to buy) and time (computer works faster). :)

Installing OpenVAS 1.0.x on Ubuntu Linux...

2009-02-08T08:15:00.000-08:00

OpenVAS (URL http://www.openvas.org) is an open source and fully GPL'ed fork of the now closed source Nessus security scanner. I will not go into the history of Nessus and why OpenVAS is a fork of that source code but will focus more on how I installed OpenVAS on my favorite Linux distro Ubuntu.

If you go to the OpenVAS site, they only have .rpm (aka RedHat) packages and can't be used on a Debian based distro like Ubuntu. Also, as a side note, if you want to do something else with OpenVAS which I am not covering, remember that you should best follow only the Ubuntu specific instructions and when that is not possible, for the Debian Etch instructions as Ubuntu uses the "Etch" branch of Debian.

The instructions below are for use with OpenVAS v1.x and not the new beta 2.0 (will write another article later when it gets out of beta).

Firstly, you will need to add the following repositories into aptitude by editing /etc/apt/sources.list and adding the following line into the sources.list file:

deb http://apt.intevation.de/ etch openvas

You then update your Ubuntu repositories by issuing the "apt-get update" command.

You then need to download the following source codes from the OpenVAS website. Which you can find at URL http://wald.intevation.org/frs/?group_id=29

They are:

openvas-libraries 1.0.2 (not needed, a .deb installer is available in the repository)
openvas-libnasl 1.0.1
openvas-server 1.0.2
openvas-plugins 1.0.4 (if there is a newer version > 1.0.4, download that instead)

Create a sub-directory in your home directory called "~/openvas1" and move all the .tar.gz source code files into this folder.

Then, you need to install certain libraries which OpenVAS uses prior to compiling the source codes you've downloaded by issuing the command:

apt-get install openvas-client libopenvas1 libopenvas1-dev libgpgme11 libgpgme11-dev bison build-essential

!
! in Ubuntu 8.10, prior to issuing the above command, you will need to install
! some libraries which are missing in Ubuntu 8.10.
!
! Download the following .deb (libgnutls13 and libopencdk10) files from the
! hardy packages (they'll work in Ubuntu 8.10)
!
! http://packages.ubuntu.com/hardy-updates/i386/libgnutls13/download
! http://packages.ubuntu.com/hardy/i386/libopencdk10/download
!
! You can install the two .deb files by issuing the command:
!
! dpkg -i libgnutls13_2.0.4-1ubuntu2.1_i386.deb
! dpkg -i libopencdk10_0.6.6-1ubuntu1_i386.deb
!

You will then need to open the three source code files, untar them and compile them. You can do this for all three packages by typing in:

tar zxvf [filename of .tar.gz file]
cd [sub-folder of same name as .tar.gz file]

./configure
make
make install
cd ..

You will need to do the above with all three files, mainly:

openvas-libnasl-1.0.1.tar.gz
openvas-server-1.0.2.tar.gz
openvas-plugins-1.0.4.tar.gz

in the above order.

You will then need to let your linux system know about the new libraries you have just compiled before the can be used by typing in:

ldconfig -v

You then need to copy the file openvas-services from the server source code folder into the /var/lib/openvas directory by issuing the following command in a bash shell:

mkdir /var/lib/openvas
cp ~/openvas1/openvas-server-1.0.2/openvas-services /var/lib/openvas/

For the first time use of OpenVAS, you will need to create a new cert and add in the first user that can login into the OpenVAS server by running both:

openvas-mkcert
openvas-adduser

To start OpenVAS, activate the server by typing in:

openvasd -D &

And running the OpenVAS client by typing:

openvas-client

If all works well, when you run openvasd, you will see it attempt to load in all the plug-ins and in the openvas-client, connect to the openvas server.

Feel free to comment!

Note: Tested on Ubuntu 7.10, 8.04 and 8.10, and I assume you are doing all this with root access and am running the kernel in i386 (32-bit) mode.

Simple way to create an ISO image of your disc in Ubuntu...

2009-02-08T08:09:00.000-08:00

Go to Terminal:

sudo umount /dev/cdrom
dd if=/dev/cdrom of=filename.iso bs=1024

To verify your ISO file is good:

md5sum /dev/cdrom
md5sum filename.iso

Both instances should produce the same md5 hash. :)

Note: "filename.iso" is only an example filename, feel free to use any name you want.

Making the Firefox browser special

2009-02-01T01:09:00.000-08:00

Let's face it, a web browser, is a web browser, is a web browser. Every operating system has at least two web browsers that users can choose to use. The difference between most browsers with Firefox is the fact that Firefox has add-ons which basically extends the functionality of the browser. I am sure that this is nothing new to most seasonal Ubuntu users, but most users new to Firefox do not realise that they can expand the functionality. This blog shows users (not in the know) how to find and add these add-ons and what are my favourite personal add-ons which you may or may not find useful.

Adding the add-ons

Launch Firefox and go to Tools -> Add-ons and the "Add-ons" windows will appear. You then go to the "Get Add-ons" tab and you can then find any and every add-on that was ever made for Firefox that Mozilla has tested and deemed safe for users to use. There are sites that offer the add-ons directly. However, getting them directly from Mozilla is a safe bet as they have been tested to work correctly "as advertised".

The best way to know what add-ons you want is to simply use the browser and ask yourself what improvements you would like to see to Firefox. Once you know what you want, simply figure out what keyword would best describe the feature you want and query in the "Get Add-ons" tab. The query result will display all add-ons that fit the search query and will then display a short description of what the add-on does. If the description fits what you want, you are then given the opportunity to install the add-on. You can also check the "Extension" tab to see what add-ons you have installed. You can also configure the behaviour of the extension to better fit your needs.

Extension/Add-ons that I use

The list below are the extensions that I use. It is in no way an endorsement to the following add-on authors but it is a list of add-ons that I use that I find useful and convenient. They are:

Ad Block Plus
Download Statusbar
PageZoom
QuickJava
Server Spy
ShowIP
SwitchProxy Tool

To know what these tools do, may I suggest you query them in the "Get Add-ons" tab and have a read yourself.

Getting the public key of a ubuntu repository

2009-01-31T03:32:00.000-08:00

I sometimes have problems when I add an APT line to the source.list and when I do and apt-get update, get an error message saying I do not have an authentication key, especially from one of the launchpad.net repositories. The usual message would be:

GPG error: http://ppa.launchpad.net intrepid Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0123456789ABCDEF

I have a short script that can help you get the correct key. Simply create a file called import-ubuntu-key.sh and type in the following code:

gpg --keyserver keyserver.ubuntu.com --recv $1
gpg --export --armor $1 | sudo apt-key add -

You then have to make the file an executable file, this can be done by using the chmod command with the +x switch:

chmod +x import-ubuntu-key.sh

To import the signature, simply type:

./import-ubuntu-key.sh 0123456789ABCDEF

The above assumes the script is located in the current directory and the repository's public key is located on the keyserver.ubuntu.com server.

Installing Ubuntu 8.10 on my EeePC 701...

2009-01-28T20:20:00.000-08:00

Got myself a 16GB class 4 SDHC card and decided to upgrade my EeePC 701 with the latest version of Ubuntu (8.10 Intrepid).

I used a DVD drive to install Ubuntu on my EeePC and almost everything worked OOTB (out of the box) with the exception of wifi and a shutting down problem.

To fix the first problem, I disabled the "Support for Atheros 802.11 wireless LAN cards" on Hardware Drivers, and rebooted.

Then, I installed the backports modules which has a working wifi driver by typing the following in a terminal shell:

sudo apt-get install linux-backports-modules-intrepid-generic

Before anyone asks... Yes, I had to do this with a wired internet connection.

To solve the shutdown problem, all I had to do was to edit the "halt" file at "/etc/default/" and add in "rmmod snd-hda-intel" on the last line of the file.

This basically gets the whole computer working as everything else is already supported by Ubuntu.

To enhance the computer, I also installed a utility called Eee Control. The latest version as of this writing is v0.8.3. You can get this utility at URL http://greg.geekmind.org/eee-control/.

This utility allows you to control the switching on/off of certain components like wifi, camera, etc. You can also overclock or underclock the EeePC with the option to auto powersave when your EeePC runs off batteries regardless of the clock speed when plugged to the wall.

To increase the lifespan of the SSD (or SDHC card in my case), we can reduce the frequency of writes to the media by adding the following into the "/etc/fstab":

tmpfs /var/tmp tmpfs noatime 0 0
tmpfs /tmp tmpfs noatime 0 0

You can also add the "noatime" to the other medias that Ubuntu accesses.

Installing the Firewalk security tool

2009-01-28T06:48:00.000-08:00

Unfortunately for all, the firewalk tool is not found in any of the Ubuntu repositories nor is there a .deb file that you can download and install. You will need to download the source code and compile the program yourself.

To get the firewalk source, go to URL http://www.packetfactory.net/projects/firewalk/. Download the source file from the site called "firewalk.tar.gz". You then need to untar the file by typing in a terminal shell:

tar -xvvzf firewalk.tar.gz

This will untar all the files and create their respective directories. You will then need to install the relavent supporting libraries and their development tools with the command:

sudo apt-get install build-essential libpcap-dev libnet1-dev libdnet-dev libdumbnet-dev

Since this tool (firewalk) was developed a few years ago, two of the libraries it uses have changed their names, we will need to link the old name to the new object name with the following sequence of commands:

cd /usr/lib
sudo ln -s libdumbnet.so libdnet.so
cd /usr/include
sudo ln -s dumbnet.h dnet.h

Before you can compile firewalk, there is one change you will need to make to the source. Gutsy (and newer Ubuntu distros) install gcc 4.0 by default, which doesn't like switch statements with no instructions in the "default" case. To fix this, just insert the "break;" command on line 193 of src/firewalk.c:

==== old =====

default:
/* empty */

==== new =====

default:
break;
/* empty */

Now, you are ready to compile everything, issue the following commands in the Firewalk directory:

./configure
make
sudo make install

To install the man pages, type in the following:

sudo mkdir /usr/local/man/man8
sudo cp man/firewalk.8 /usr/local/man/man8

You are now ready to use the firewalk utility command. :)

Note: This was done on a Ubuntu 8.10 distro.

Life with Ubuntu

2009-01-27T17:50:00.000-08:00

Just started this blog today as I wanted to write about how easy it is to use Ubuntu Linux. I will only write about what I do, use, experience and think about Ubuntu (for now) and hopefully help and assist others on this journey as well. A little background, I have been using Ubuntu for the last 4 years (since Ubuntu 5.04) and use Ubuntu on all my own PCs with the exception of my laptop which I use in the office that has Windoze XP (with wubi and Ubuntu 7.10). One of my laptops is an EeePC 701 so you will also read a bit of Eee centric posts as well as security applications which I use for work. More to come in the following days... :)