My life with Ubuntu

With the focus of most users being on Unity and Gnome 3, I am still happily sitting on Ubuntu 10.04 and hopefully don't have to decide it's future until Canonical stops the LTS (Long Term Support) on this build.  Other than that, it works beautifully with my only gripe at the moment being Adobe Flash on Linux being extremely slow (compared to the same hardware running Windoze).  Besides that, all is good. :)

Installing THC-Hydra 7.0

THC just released a new version of Hydra (URL http://thc.org/thc-hydra/), a very fast network logon cracker which support many different services (so the website says). I decided to install this on my home laptop. On Ubuntu, you will need to compile the source code provided at URL http://www.thc.org/releases/hydra-7.0-src.tar.gz

I proceeded to untar the source code and when I did the ./configure command, a list of libraries that Hydra requires was missing from my laptop. I only managed to install some of the libraries with the command:

sudo apt-fast install libpq-dev libsvn-dev libssh-dev

However, when I ran the ./configure command again, not all libraries were installed (I couldn't' figure out which ones they wanted). The output I got after the second ./configure was:

Starting hydra auto configuration ...
Detected 32 Bit Linux OS

Checking for openssl (libssl, libcrypto, ssl.h, sha.h) ...
... found
Checking for idn (libidn.so) ...
... NOT found, unicode logins and passwords will not be supported
Checking for pcre (libpcre.so, pcre.h) ...
... found
Checking for Postgres (libpq.so, libpq-fe.h) ...
... found
Checking for SVN (libsvn_client-1 libapr-1.so libaprutil-1.so) ...
... found
Checking for firebird (libfbclient.so) ...
... NOT found, module firebird disabled
Checking for MYSQL client (libmysqlclient.so, math.h) ...
... found
Checking for AFP (libafpclient.so) ...
... NOT found, module Apple Filing Protocol disabled - Apple sucks anyway
Checking for NCP (libncp.so / nwcalls.h) ...
... found
Checking for SAP/R3 (librfc/saprfc.h) ...
... NOT found, module sapr3 disabled
Get it from http://www.sap.com/solutions/netweaver/linux/eval/index.asp
Checking for libssh (libssh/libssh.h) ...
... found
Checking for Oracle (libocci.so libclntsh.so / oci.h) ...
... NOT found, module Oracle disabled
Checking for GUI req's (pkg-config, gtk+-2.0) ...
... found

Hydra will be installed into .../bin of: /usr/local
(change this by running ./configure --prefix=path)

Writing Makefile.in ...
now type "make"

I then proceeded to issue the make && sudo make install command to compile and install the program.

The program seems to work and I hope somebody out there reading this can help me with the missing "NOT found, module..." errors.

This blog is so dead (not!)...

I know I have been rather quiet with my "Life with Ubuntu" blog. Work has gotten the better part of me and what little time I have now is usually me messing about on my linux based Nokia N900.

My last post mentioned that was going to test Ubuntu 10.10 but looking at all the changes Canonical has been doing, I think I will stick to my Ubuntu 10.04 LTS build until something compels me to upgrade (perhaps to the next LTS version).

There are a few article I plan to post in this blog, but it will tie in with another blog I've created called Life with Maemo which is about my Nokia N900 computer (with phone functionality) running the Maemo 5 operating system (which itself is an ARM based Debian linux "ecosystem").

Ohh! a belated Merry Christmas and a (belated!) Happy New Year!

What I've been up to...

In case you didn't know, Ubuntu 10.10 was released on 10.10.10. I've not upgraded my systems as I am quite happy with 10.04 and the promise of it's LTS (Long Term Support). That said, I'll pick one of my machines and see how good 10.10 is and post my findings at a later date.

What have I been up to lately? My friend (droll) introduced me to a nifty little device called the Nokia N900 which is based of Maemo which is derived from Debian Linux.

I've gotten a nifty overclocking which allows my to underclock the device at 125MHz all the way to 1.15GHz (the stock speeds at 250MHz till 600MHz). I've also gotten kismet and nmap installed on this device so wireless testing is now simply putting my phone in my pocket and walking around. I will soon be trying to get install OpenVAS which should make for a rather complete basic pentesting setup, all on my phone. I may even try Ubuntu 9.04 which somebody ported over to the N900 (it's ARM based).

Though this site is called "Life with Ubuntu", I guess I'll be including some Maemo/MeeGo blogs in the future.

News of interest for the month of July 2010...

inundator v0.5 Released – IDS/IPS/WAF Evasion & Flooding Tool

inundator is a multi-threaded, queue-driven, IDS evasion tool. Its purpose is to anonymously flood intrusion detection systems (specifically Snort) with traffic designed to trigger false positives via a SOCKS proxy in order to obfuscate a real attack.

http://inundator.sourceforge.net/


Safe3 SQL Injector – Automatic Detection & Exploitation Of SQL Injection Flaws

Safe3 SQL Injector is one of the most powerful penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of back-end database servers.

http://code.google.com/p/safe3si/


REMnux: A Linux Distribution For Reverse-Engineering Malware

REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. The distribution is based on Ubuntu and is maintained by Lenny Zeltser.

http://zeltser.com/remnux/


Andiparos – Open Source Web Application Security Assessment Tool

Andiparos is a fork of the famous Paros Proxy. It is an open source web application security assessment tool that gives penetration testers the ability to spider websites, analyze content, intercept and modify requests, etc.

http://code.google.com/p/andiparos/


Metasploit Framework 3.4.1 Released – 16 New Exploits, 22 Modules & 11 Meterpreter Scripts

The Metasploit Project is proud to announce the release of the Metasploit Framework version 3.4.1. This release sees the first official non-Windows Meterpreter payload, in PHP.

http://www.metasploit.com/


thc-ipv6 Toolkit – Attacking the IPV6 Protocol

A complete tool set to attack the inherent protocol weaknesses of IPV6 and ICMP6, and includes an easy to use packet factory library. Please note to get full access to all the available tools you need to develop IPV6 tools yourself or submit patches, tools and feedback to the thc-ipv6 project.

http://thc.org/thc-ipv6/


Sagan – Real-time System & Event Log (syslog) Monitoring System

Sagan is a multi-threaded, real time system- and event-log monitoring system, but with a twist. Sagan uses a “Snort” like rule set for detecting “bad things” happening on your network and/or computer systems. If Sagan detects a “bad thing” happening, that event can be stored to a Snort database (MySQL/PostgreSQL) and Sagan will correlate the event with your Snort Intrusion Detection/Intrusion Prevention (IDS/IPS) system. Sagan is meant to be used in a ‘centralized’ logging environment, but will work fine as part of a standalone Host IDS system for workstations.

http://sagan.softwink.com/


PlainSight – Open Source Computer Forensics LiveCD

PlainSight is a versatile computer forensics environment that allows inexperienced forensic practitioners perform common tasks using powerful open source tools such as RegRipper, Pasco, Mork, Foremost and many more.

http://www.plainsight.info/


WPA2 Vulnerability Discovered – “Hole 196″ – A Flaw In GTK (Group Temporal Key)

Malicious insiders can exploit the vulnerability, named “Hole 196″ by the researcher who discovered it at wireless security company AirTight Networks. The moniker refers to the page of the IEEE 802.11 Standard (Revision, 2007) on which the vulnerability is buried. Hole 196 lends itself to man-in-the-middle-style exploits, whereby an internal, authorized Wi-Fi user can decrypt, over the air, the private data of others, inject malicious traffic into the network and compromise other authorized devices using open source software, according to AirTight.

http://www.networkworld.com/newsletters/wireless/2010/072610wireless1.html


iKAT – Interactive Kiosk Attack Tool v3

iKAT was designed to aid security consultants with the task of auditing the security of a Windows based internet Kiosk terminal. iKAT is designed to provide access to the underlying operating system of a Kiosk terminal by invoking native OS functionality. This tool should be (and is) used by Kiosk vendors/developers/suppliers to test the security of their own Kiosk products.

http://ikat.ha.cked.net/


Knock v1.4.2b – Subdomain Enumeration/Brute-Forcing Tool

Knock is a python script designed to enumerate sub-domains on a target domain through a wordlist.

http://knock.gianniamato.it/download.php


Websecurify 0.7RC1 - powerful web application security testing

Websecurify is a powerful web application security testing environment designed from the ground up to provide the best combination of automatic and manual vulnerability testing technologies.

http://code.google.com/p/websecurify/

News of interest for the month of June 2010...

Websecurify 0.6 - powerful web application security testing

Websecurify is a powerful web application security testing environment designed from the ground up to provide the best combination of automatic and manual vulnerability testing technologies.

http://code.google.com/p/websecurify/


w3af 1.0-rc3 Available For Download – Web Application Attack & Audit Framework

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.

http://w3af.sourceforge.net/


OpenSCAP – Framework For Implementing SCAP (Security Content Automation Protocol)

The OpenSCAP Project was created to provide an open-source framework to the community which enables integration with the Security Content Automation Protocol (SCAP) suite of standards and capabilities. It is the goal of OpenSCAP to provide a simple, easy to use set of interfaces to serve as the framework for community use of SCAP.

http://www.open-scap.org/page/Main_Page


Onapsis Bizploit – ERP Penetration Testing Framework

Bizploit is the first Opensource ERP Penetration Testing framework. Developed by the Onapsis Research Labs, Bizploit assists security professionals in the discovery, exploration, vulnerability assessment and exploitation phases of specialized ERP Penetration Tests.

http://www.onapsis.com/research.html#bizploit


Samurai Web Testing Framework v0.8 Released – Pen Testing Security LiveCD

The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites.

http://samurai.inguardians.com/


Knock v1.3b – Subdomain Enumeration/Brute-Forcing Tool

Knock is a python script designed to enumerate sub-domains on a target domain through a wordlist.

http://knock.gianniamato.it/download.php

sectool – Security Audit Tool and IDS

sectool is a security tool that can be used both as a security audit as well as a part of an intrusion detection system. It consists of set of tests, library and textual/graphical frontend. Tests are sorted into groups and security levels. Administrators can run selected tests, groups or whole security levels.

https://fedorahosted.org/sectool/

Anti-virus revisited...

I remember writing a short post (read here) about why Ubuntu users don't need an anti-virus. However, over the past few months, my opinion on this has changed.

For starters, linux (unix in general) is more secure by design unless you are the village idiot who insist on logging into your Ubuntu setup as root (you actually need to hack this as Ubuntu by default prevents users from logging is as the root user). What few viruses/worms that do exist can only affect the user as per his/her access rights to the system.

However (I did say I've changed my opinion on this), Ubuntu users do receive a lot of files from other users who (gasp!) use Windoze (and Macs) and these platforms do have viruses/worms. What we do not want to be is a carrier for those malware. So installing an anti-virus should be done only for the occasional health scan and to maybe scan new files as you get them.

I have Googled around for a decent, free, linux based anti-virus and have found the following:

1. ClamAV (URL http://www.clamav.net/lang/en/) or check with Synaptics
   
2. avast! (URL http://www.avast.com/linux-home-edition)
   
3. AVG (URL http://free.avg.com/gb-en/download.prd-afl)
   
4. F-Prot (URL http://www.f-prot.com/products/home_use/linux/)

I ended up using AVG for myself since it was a CLI only installer (yes, no GUI) and didn't require me to register to use it (as you can see, I only tested one product). In any case, if you want to give it a try, these are the free ones I could find. Feel free to let me know what you think of this post or the product if you tried them.

You can also check the Ubuntu page on anti-viruses here.