Tuesday, October 9, 2018
VERR_VMX_MSR_VMXON_DISABLED ao iniciar uma imagem da caixa virtual do Oracle
Falha ao abrir uma sessão para a máquina virtual
O VT-x está desativado no BIOS. (VERR_VMX_MSR_VMXON_DISABLED).
Código do resultado: E_FAIL (0x80004005)
Componente: Console
Interface: IConsole {8ab7c520-2442-4b66-8d74-4ff1e195d2b6}
Além disso, vejo que a guia de aceleração no Virtual Box está desativada.
Eu acredito que o VirtualBox está jogando esse erro por vários motivos. Muito irritante que seja um erro para tantas coisas.
Potenciais pegadinhas:
Você não habilitou o VT-x no VirtualBox e é necessário para a VM.
Para ativar: abra o vbox, clique na VM, clique na caixa de seleção Configurações ..., Sistema-> Aceleração-> VT-x.
Você não habilitou o VT-x no BIOS e é necessário.
Verifique o manual da placa-mãe, mas basicamente você deseja inserir o BIOS logo após a máquina liga (geralmente tecla DEL, F2, F12, etc) e encontrar tag "Avançado", digite "configuração de CPU", em seguida, ative "Tecnologia de Virtualização Intel".
Seu processador não suporta VT-x (por exemplo, um Core i3).
Nesse caso, seu BIOS e VirtualBox não devem permitir que você tente habilitar o VT-x (mas, se o fizer, provavelmente você obterá uma falha na VM).
Você está tentando instalar ou inicializar um sistema operacional convidado de 64 bits.
Eu acho que o sistema operacional de 64 bits requer verdadeira passagem da CPU, que requer o VT-x. (Um especialista em VM pode comentar sobre esse ponto).
Você está tentando alocar> 3 GB de RAM para a VM.
Semelhante ao ponto anterior, isso requer: (a) um sistema host de 64 bits; e (b) passagem de hardware verdadeira, isto é, VT-x.
Assim, para o meu pequeno mexer máquina que eu estou ressuscitando que tem 8 GB de RAM, mas apenas um Core i3 ye-olde, estou tendo sucesso se eu instalar: versão do Linux de 32 bits, alocando 2,5 GB RAM.
Ah, e onde quer que eu diga "VT-x" acima, isso obviamente se aplica igualmente à tecnologia de virtualização "AMD-V" da AMD.
Fierce - DNS reconnaissance
Fierce is presented by Schwager, in Fierce: A DNS reconnaissance tool for locating non-contiguous IP space (https://github.com/mschwager/fierce), GitHub © 2018, as follows:
Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames against specified domains.
Fierce uses zone transfer, dictionary attacks, and reverse resolution to gather hostnames and subdomains along with the IP addresses of a domain, and it has the option to search for related names (for example, domain company.com, corpcompany.com, or webcompany.com). In the following example, we will use search to identify hostnames of google.com:
fierce -dns website
Monday, October 8, 2018
Metadata removal/DLP tools
As DLP is an important method to avoid data loss. The above example is quite generic to get us some idea about how DLP works. Now as per our topic we are more interested in metadata removal. So there are also different tools available to remove metadata or we can also say them as metadata DLP tools. Some of those are mentioned below.
MetaShield Protector
MetaShield Protector is a solution which helps to prevent data loss through office documents published on the website. It is installed and integrated at web server level of the website. The only limitation of this is that, it is only available for IIS web server. Other than that It supports a wide range of office documents. Some of the popular file types are ppt, doc, xls, pptx, docx, xlsx, jpeg, pdf, etc. On a request for any of these document types, it cleans it on the fly and then delivers it. MetaShield Protector can be found at https://www.elevenpaths.com/services/html_en/metashield.html. The tool is available at https://www.elevenpaths.com/labstools/emetrules/index.html.
MAT
MAT or metadata anonymization toolkit is a graphical user interface tool which also helps to remove metadata from different types of files. It is developed in Python and utilizes hachoir library for the purpose. As earlier we discussed a bit about hachoir Python library and one of its project in hachoir-metadata portion, this is another project based on the same library. The details regarding the same can be found here https://mat.boum.org/.
The best thing about MAT is that it is open source and supports a wide range of file extensions such as png, jpeg, docx, pptx, xlsx, pdf, tar, mp3, torrent etc.
MyDLP
It is a product by Comodo which also provides wide range of security product and services. MyDLP is an one stop solution for different potential data leak areas. In an organization not only documents but also emails, USB devices, and other similar devices are potential source of data leak. And in this case it allows an organization to easily deploy and configure this solution to monitor, inspect, and prevent all the outgoing critical data. The details of MyDLP can be found here. http://www.mydlp.com.
OpenDLP
OpenDLP is an open source centrally managed data loss prevention tool released under the GPL. From a centralized web application it can identify sensitive data in different types of systems such as Windows and Unix as well as different types of databases such as MySQL and MSSQL. The project can be found here. https://code-google-com.eztncc.vccs.edu:2443/p/opendlp/.
Doc Scrubber
A freeware to scrub off hidden data from word documents (.doc). Some of its popular features are it allows to scrub multiple doc files at a time. Doc Scrubber can be downloaded from http://www.javacoolsoftware.com/dsdownload.html.
Removing Geo-tags
As we discussed earlier that how geotags can be dangerous for a user in an attacker point of view, as it reveals exact location about a user, here some settings in Picasa can help us to remove these geotags. Picasa, the image organizing and editing application by Google can help to remove geotags from images. The link to the help and support page is http://support.google.com.eztncc.vccs.edu:2048/picasa/bin/answer.py?hl=en&answer=70822.
We can also use Exif Tool discussed earlier to remove such data.
Though mainly metadata is used for the organization and linking of data it can also be critical during cyber investigations as well as pentest exercises. As discussed earlier, most of them are harmless but sometimes it can reveal some sensitive data. As many individuals as well as organizations are unaware of its existence, they don’t pay much attention to it. The solutions discussed above must be tried to make it easier to mitigate any risk arising from such information.
Google Hacking - list
inurl:
This operator allows looking for keywords in the uniform resource locator (URL) of the site. It is useful to find out pages which follow a usual keyword for specific pages, such as contact us. Generally, as the URL contains some keywords associated with the body contents, it will help us to find out the equivalent page for the keyword we are searching for.
Example: inurl:hack
allinurl:
Similar to “inurl” this operator allows looking for multiple keywords in the URL. So we can search for multiple keywords in the URL of a page. This also enhances the chances of getting quality content of what we are looking for.
Example: allinurl:hack security
intext:
This operator makes sure that the keyword specified is present in the text of the page. Sometimes just for the sake of SEO, we can find some pages only contain keywords to enhance the page rank but not the associated content. In that case we can use this query parameter to get the appropriate content from a page for the keyword we are looking for.
Example: intext:hack
allintext:
Similar to the “intext” this operator allows to lookup for multiple keywords in the text. As we discussed earlier the feature of searching for multiple keywords always enhances the content quality in the result page.
Example: allintext:data marketing
intitle:
It allows us to restrict the results by the keywords present in the title of the pages (title tag: <title>XYZ</title>). It can be helpful to identify pages which follow a convention for the title of the pages such as directory listing by the keywords “index of” and most of the sites provide the keywords in the title for improving the page rank. So this query parameter always helps to search for a particular keyword.
Example: intitle:blueocean
allintitle:
This is the multiple keyword counterpart of “intitle” operator.
Example: allintitle:blueocean market
filetype:
This operator is used to find out files of a specific kind. It supports multiple file types such as pdf, swf, kml, doc, svg, txt, etc. This operator comes handy when we are only looking for specific type of files on a specific domain.
Example: filetype:pdf, site:xyz.com, filetype:doc
ext:
The operator ext simply stands for extension and it works similar to the filetype operator.
Example: ext:pdf
define:
This operator is used to find out the meaning of the keyword supplied. Google returns dictionary meaning and synonyms for the keyword.
Example: define:data
AROUND
This operator is helpful when we are looking for the results which contain two different keywords, but in close association. It allows us to restrict the number of words as the maximum distance between two different keywords in the search results.
Example: A AROUND(6) Z
AND
A simple Boolean operator which makes sure keywords on both the side are present in the search results.
Example: data AND market
OR
Another Boolean operator which provides search results that contain either of the keyword present on both the sides of the operator.
Example: data OR intelligence
NOT
Yet another Boolean operator which excludes the search results that contain the keyword followed by it.
Example: lotus NOT flower
“”
This operator is useful when we need to search for the results which contain the provided keyword in the exact sequence. For example we can search pages which contain quotes or some lyrics.
Example: “time is precious”
-
This operator excludes the search results which contain the keyword followed by it (no space).
Example: lotus -flower
∗
“∗ is precious”
..
Example: japan volcano 1990..2000
info:
Example: info:uol.com
related:
cache:
time
time france
weather
Example: weather sweden
Calculator
Example: 39∗(9823-312)+44/3
Convertor
Example: 6 feet in meters
Sunday, October 7, 2018
RFC1918
The 10.0.0.1 and 10.0.0.2 are a part of a series of netblocks set aside for private networks by RFC1918, IP Address Allocation for Private Internets. RFC1918 sets aside three large ranges, 10.0.0.0-10.255.255.255 (10.0.0.0/8), 172.16.0.0-172.31.255.255 (172.16.0.0/12), and 192.168.0.0-192.168.255.255 (192.168.0.0/16).
Wireshark overview of tabs
You recently used Wireshark to capture a series of packets. You are expanding one of the packets into its constituent sections. Which of the following is not a section in a captured packet?
a. Frame
b. Ethernet II
c. Internet Protocol version 4
d. Application
Frame: This is the physical layer and describes how many bytes are on the wire.
Ethernet II: This is the data link layer and contains source and destination MAC addresses.
Internet Protocol version 4: This is the network layer and contains source and destination IP addresses.
Transmission Control Protocol: This is the transport layer and contains source and destination port numbers.
Data of some type: There is no data in this packet because it is an SYN packet, part of the TCP handshake. But if this were HTTP data, for example, the section would be titled HTTP, and it would include the raw data.
Ethernet II: This is the data link layer and contains source and destination MAC addresses.
Internet Protocol version 4: This is the network layer and contains source and destination IP addresses.
Transmission Control Protocol: This is the transport layer and contains source and destination port numbers.
Data of some type: There is no data in this packet because it is an SYN packet, part of the TCP handshake. But if this were HTTP data, for example, the section would be titled HTTP, and it would include the raw data.
Subscribe to:
Posts (Atom)
.png)