Wednesday, December 2, 2020

lshw command within Linux

The lshw command within Linux can return details concerning the hardware of a machine.  The command below returns a list of all hardware.

sudo lshw -short


The command below shows just the entries for the disk class.

sudo lshw -short -C disk

More details can be obtained by excluding the -short parameter.

sudo lshw -C disk


https://www.cloudsavvyit.com/14863/how-to-use-lshw-in-linux-with-a-practical-example/

inxi for Linux

The inxi application is an utility for Linux to obtain system information.  To install on a Debian-based system, use the command:

sudo apt install inxi

The command below will display CPU information.

inxi -C


The following command will return memory details.

sudo inxi -m

The command below will display a summary of various information.

sudo inxi -F

https://www.cloudsavvyit.com/8123/the-linux-system-information-tool-inxi/

Open Shell

Open Shell, originally known as Classic Shell, is open-source software that allows you to replace the standard Start Menu on Windows 10 and Windows 8.

https://www.bleepingcomputer.com/news/microsoft/open-shell-brings-back-the-glory-days-of-the-windows-start-menu/

https://github.com/Open-Shell/Open-Shell-Menu



youtube-dl

The youtube-dl application is a command-line utility to download YouTube videos.  Some other sites are supported as well.  This app requires Python, so it must be installed using instructions such as the link below:

https://www.python.org/downloads/release/python-390/

If Python 3 is used, an error may be returned due to python not being found.  Use the following commands:

whereis python3
sudo ln -s /usr/bin/python3 /usr/bin/python

To install youtube-dl, use the commands below:

sudo curl -L https://yt-dl.org/downloads/latest/youtube-dl -o /usr/local/bin/youtube-dl
sudo chmod a+rx /usr/local/bin/youtube-dl

To use the application, use the command with an URL:

/usr/local/bin/youtube-dl -k <URL of video>

The -k switch will download the file in multiple formats, including .MP4.  If you only wish to use .MP4, use the switch -f mp4 before the URL.

https://github.com/ytdl-org/youtube-dl

DeepBlueCLI

DeepBlueCLI is a PowerShell Module for threat hunting via Windows Event Logs.

https://www.kitploit.com/2020/11/deepbluecli-powershell-module-for.html

https://github.com/sans-blue-team/DeepBlueCLI


Winstall

Winstall is an site to create Winget commands.  This allows applications to be installed via a command line interface.

https://www.bleepingcomputer.com/news/microsoft/windows-10-bulk-install-essential-apps-with-this-free-tool/

https://winstall.app/

Office 365 Network Connectivity Tool

Below is a link to an Office 365 network connectivity tool.

https://connectivity.office.com/

Sunday, November 1, 2020

Extended GodMode Utility for Windows

Extended GodMode is an utility for Windows to display a large amount of settings within one application.  No installation is required.

https://www.wintools.info/index.php/extended-godmode

Disable Private Wi-Fi MAC Addresses on iPhone and iPad

Starting with iOS version 14, a private MAC address feature is enabled.  Any iOS device will now provide a different MAC address for each Wi-Fi network they connect to.

To disable this option, access Settings > Wi-Fi. Locate the Wi-Fi network in question and tap the “i” icon at the right side of the Wi-Fi network name.  Disable the “Private Address” option.



Methods to determine Linux kernel and operating system version with Linux Mint

One method to determine the current Linux kernel and operating system version, use the following command.

lsb_release -a


Another method is via the following command:

cat /etc/os-release


The command below is another method to display current kernel level:

hostnamectl





Install Vivaldi within Linux Mint

One method to install the web browser Vivaldi within Linux Mint is via the commands below.

sudo apt install wget gnupg2 software-properties-common

sudo wget -qO- https://repo.vivaldi.com/archive/linux_signing_key.pub | sudo apt-key add -

sudo echo 'deb https://repo.vivaldi.com/archive/deb/ stable main' | sudo tee /etc/apt/sources.list.d/vivaldi.list

sudo apt update

sudo apt install vivaldi-stable

Per https://help.vivaldi.com/article/html5-proprietary-media-on-linux/, an additional command may be required to view certain video content.

sudo /opt/vivaldi/update-ffmpeg

One method to view keyboard shortcuts within Chrome OS

One method to view keyboard shortcuts within Chrome OS is to use the following combination:

ctrl + alt + /

A new dialog box should appear with a list of keyboard shortcuts combinations.



Pixlr

Pixlr is an online photo editor web site.

https://pixlr.com/x/

Surveyor

Surveyor is a Python utility that queries Endpoint Detection and Response products and summarizes the results.

https://github.com/redcanaryco/surveyor

Saturday, October 3, 2020

Command to show listening ports within Linux

Below is a command to show listening ports within Linux.

sudo netstat -plnt | grep "LISTEN" | awk '{print $4 "\t" $7}'

One method to disable IPv6 with Linux

One method to disable IPv6 with Linux Mint is to use the following commands.

sudo nano /etc/sysctl.conf

Add the following lines to the bottom of the file and save it:

# IPv6 disabled
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Restart sysclt using the following command:

sudo sysctl -p

If IPv6 is still enabled after rebooting, you create the file /etc/rc.local and and use the following lines:

#!/bin/bash
# /etc/rc.local

/etc/sysctl.d
/etc/init.d/procps restart

exit 0

Use chmod command to make the file executable:

sudo chmod 755 /etc/rc.local

To manually disable IPv6, use the commands below:

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1

http://itsfoss.com/disable-ipv6-ubuntu-linux

Terminal error within Linux Mint

When attempting to launch an application via a terminal session within Linux Mint, the following error was returned:

Error opening terminal: xterm-256color.

Use the following command before launching the application.

export TERM=xterm

RClone

RClone is an open-source client for accessing cloud storage.  It supports multiple operating systems and cloud services.

https://rclone.org/

https://www.itprotoday.com/hybrid-cloud/how-access-s3-buckets-windows-or-linux

ChromeOS system performance information

 To view system performance information within ChromeOS, enter the following URL:

chrome://sys-internals/

By default, three columns should be present:  CPU, Memory, and Zram.

https://www.howtogeek.com/687563/how-to-view-system-performance-statistics-on-your-chromebook/



Privatezilla

Privatezilla integrates the most important Windows 10 privacy settings and allows you to quickly perform a privacy check against these settings. 

https://www.builtbybel.com/ms-apps/privatezilla

https://github.com/builtbybel/privatezilla/releases/



O&O ShutUp10

O&O Shutup10 is a tool that allows an user to change an amount of Windows 10 privacy settings ranging from telemetry to data usage collection in Microsoft Edge.  Shutup10 lists each privacy setting, whether it is recommended that they be disabled, and potential issues that disabling it may cause.

https://www.oo-software.com/en/shutup10



BigBlueButton

BigBlueButton is an open-source project for video conferencing.

https://4sysops.com/archives/zoom-alternative-bigbluebutton-free-video-conferencing-tool/

https://bigbluebutton.org


Wednesday, September 2, 2020

Blackweb component for Squid

Blackweb is a project that collects and unifies public blocklists of domains (porn, downloads, drugs, malware, spyware, trackers, bots, social networks, warez, weapons, etc.) to make them compatible with Squid.

OpenCanary

OpenCanary is a daemon that runs canary services, which trigger alerts when (ab)used. The alerts can be sent to a variety of sources, including syslog, emails and a companion daemon opencanary-correlator.

lsof command within Linux

The lsof command within Linux by default lists open files.  But the command can also show open network ports.  The example below returns any process with the name "team":

sudo lsof -i | grep "team"



Below is an example to show any process using the TCP port 5939:

sudo lsof -i TCP:5939


The next example shows processes that have listening ports:

sudo lsof -i | grep "LISTEN"


Additional examples can be found at https://www.linuxtechi.com/lsof-command-examples-linux-geeks/.

Bloatbox

Bloatbox is an utility to remove pre-installed apps from Windows 10.


Netenum

Netenum passively monitors the ARP traffic on the network. It extracts basic data about each active host, such as IP address, MAC address and manufacturer. The main objective of this tool is to find active machines without generating too much noise.

WuMgr

Update Manager for Windows, also known as WuMgr, is a free open-source tool for Windows 10 that allows you to manage Windows Updates without using the first-party tools such as Settings and Control Panel.

https://github.com/DavidXanatos/wumgr/releases/

https://www.bleepingcomputer.com/news/microsoft/install-windows-10-updates-manually-with-this-open-source-tool/


Saturday, August 1, 2020

Color within grep output

Below is an example of how to include color within the grep command output.

grep --color=always -E 'text|$' filename


Tsunami

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities.  This project was open-sourced via Google in 2020.


DesktopComposer

DesktopComposer is an open source tool that simplifies Start Menu and Desktop shortcut deployment in Windows 10, Windows Server 2016, and Windows Server 2019 with Group Policy.


DevNodeClean

On a computer that is running Windows Server 2003 or a later version, a storage device that is connected by using a fiber channel or by using the iSCSI protocol may be connected for only a short time. When a storage device is connected, Windows creates registry information for the device. Over time, the registry may contain many entries for devices that will never be used again. This utility can be used to remove this information from the registry.

https://www.microsoft.com/en-us/download/details.aspx?id=42286

https://blog.workinghardinit.work/2020/05/25/use-cases-for-devnodeclean-exe/

Pingcastle

PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level with a methodology based on a risk assessment and maturity framework.

https://www.darknet.org.uk/2020/05/pingcastle-active-directory-security-assessment-tool/

https://www.pingcastle.com

SharpApp

SharpApp is a free and portable tool building upon a PowerShell engine and community powered script files for disabling telemetry functions in Windows 10, uninstalling preinstalled apps, installing software packages and automating Windows tasks with integrated PowerShell scripting.

https://github.com/mirinsoft/sharpapp

https://www.bleepingcomputer.com/news/microsoft/debloating-windows-10-and-increasing-privacy-with-sharpapp/

Cloudfare DNS service

Cloudfare has some DNS server addresses that block malware and/or adult content. 

Cloudflare DNS, no blocking:
  • Primary DNS: 1.1.1.1
  • Secondary DNS: 1.0.0.1
Cloudflare DNS, blocking malware only:
  • Primary DNS: 1.1.1.2
  • Secondary DNS: 1.0.0.2
Cloudflare DNS, blocking malware and adult content:
  • Primary DNS: 1.1.1.3
  • Secondary DNS: 1.0.0.3

Sunday, July 5, 2020

Enable Microsoft spell-checker within Chrome

Microsoft has released a new browser spell-checker edition.  It is enabled by default on Microsoft Edge version 83 or later but Google has not enabled the feature on Chrome. To enable within Google Chrome:

Type "chrome://flags" in the address bar.
Type "Use the Windows OS spell checker" in the search bar.
Click on the drop-down menu and select Enable.


How to verify Windows Defender is using the cloud protection component

To verify that the cloud protection/submission component is functional within Windows Defender, launch an elevated command prompt and enter the following command:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -ValidateMapsConnection


The link below has a test .EXE to download.

https://aka.ms/ioavtest


Musicolet Music Player

Musicolet Music Player is an Android media player for local .MP3 files.  The app has an option to scan for available files.

Openports.co

Openports.co is a web site that will return information using various ports.



Windows Terminal

Windows Terminal is an interface for Command Prompt, PowerShell, and WSL.

https://www.microsoft.com/en-us/p/windows-terminal-preview/9n0dx20hk701?activetab=pivot:overviewtab

https://github.com/microsoft/terminal/blob/master/doc/cascadia/SettingsSchema.md

https://github.com/microsoft/terminal/blob/master/doc/user-docs/UsingJsonSettings.md

https://www.howtogeek.com/673729/heres-why-the-new-windows-10-terminal-is-amazing/




Astsu

Astsu is a network scanner tool developed in Python 3 using scapy.

PoShKeePass

PoShKeePass is a PowerShell module that combines PowerShell and the KeePassLib API to provide management for KeePass databases.

Monday, June 1, 2020

ConfigureDefender

ConfigureDefender is a small utility for configuring Windows 10 built-in Defender Anti-Virus settings. It is a portable application; no installation is required.

https://github.com/AndyFul/ConfigureDefender

https://www.bleepingcomputer.com/news/microsoft/windows-10-defenders-hidden-features-revealed-by-this-free-tool/


Surfing game within Microsoft Edge

Microsoft Edge starting with version 83 has a built-in surfing game.  To launch the game, use the URL below:

edge://surf


BurnBytes

BurnBytes is a portable utility to clean up storage space within Windows 10.

Cowrie SSH/Telnet Honeypot

Crowrie is a SSH and Telnet Honeypot.

https://github.com/cowrie/cowrie

https://www.cowrie.org/

atop


Atop is an ASCII full-screen performance monitor for Linux

https://www.atoptool.nl/

Nray

Nray is a free, platform independent, and distributed network scanner.

https://nray-scanner.org/

https://github.com/nray-scanner/nray


AutoRDPwn

AutoRDPwn is a post-exploitation framework created in Powershell, designed primarily to automate the Shadow attack on Microsoft Windows computers.

https://www.kitploit.com/2020/05/autordpwn-v51-shadow-attack-framework.html

https://github.com/JoelGMSec/AutoRDPwn

scrcpy

Scrcpy is an application provides display and control of Android devices connected on USB (or over TCP/IP). It does not require any root access. It works on GNU/Linux, Windows and macOS.

PlumHound

PlumHound operates by wrapping BloodHoundAD's graphical Neo4J backend cypher queries into operations-consumable reports. Analyzing the output of PlumHound can steer security teams in identifying and hardening common Active Directory configuration vulnerabilities and oversights.

Friday, May 1, 2020

Portable version option with Vivaldi

Within the Vivaldi web browser installer, an option is available to use a standalone portable version.  Within the initial dialog box, click on the Advanced button.


Select Install standalone under the Installation Type drop-down menu.


To update the standalone version, use the  Help -> Check for Updates.




Google Chrome "Guest Mode"

Google Chrome within ChromeOS has had a "Guest Mode" for some time.  But the same feature is now available for other platforms such as Windows.  Using this option,  Chrome will delete all browsing activity from the computer after exiting the browser.

To use this option, launch Chrome with the command line switch --guest.



Free alternatives to Visio

Below are a few free alternatives to Microsoft Visio.

https://docs.google.com/drawings

https://app.diagrams.net/

https://www.lucidchart.com/


Sandboxie

Sandboxie is an old utility that originally attempted to "sandbox" Internet Explorer within Windows.  The application now has been released as open-source.

https://www.sandboxie.com/

https://news.sophos.com/en-us/2020/04/09/sandboxie-is-now-an-open-source-tool/


Photopea

Photopea is an online photo editor.

https://www.photopea.com/

Wazuh

Wazuh is an open source security monitoring solution for threat detection, integrity monitoring, incident response and compliance.  Agents are available for Windows, Linux, and MacOS.

https://wazuh.com/

XODO

XODO is an online PDF editor.

https://www.xodo.com/

Wednesday, April 1, 2020

Registry hack to disable Bing from Windows Search

Below is a Registry file that contains two keys to disable the Bing component from Windows Search with Windows 10.


Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search]
"CortanaConsent"=dword:00000000
"BingSearchEnabled"=dword:00000000


https://www.bleepingcomputer.com/news/microsoft/windows-10-search-is-broken-and-shows-blank-results-how-to-fix/

RedRabbit

RedRabbit is a PowerShell script for penetration testers.  It includes options such as a network scanner and DNS resolver.




https://github.com/securethelogs/RedRabbit

Betwixt

Betwixt is a local proxy to analyze web traffic outside the browser using familiar Chrome DevTools interface.  Versions are available for MacOS, Linux, and Windows.

https://github.com/kdzwinel/betwixt

Infection Monkey

Infection Monkey is a penetration testing tool. It’s loaded with lots of advanced exploits as well as the ability to check for common security mistakes like weak passwords.   It’s available for Windows, Linux, OpenStack, vSphere, Amazon Web Services, Azure, and Google Cloud Platform networks.

PhotoFlare

PhotoFlare is a free image utility for Linux and Windows.

https://www.omgubuntu.co.uk/2020/01/photoflare-free-photo-editor

https://photoflare.io/

Indexer Diagnostics

Indexer Diagnostics is an utility to help troubleshoot and/or fix Windows Search problems with Windows 10 devices.

https://www.bleepingcomputer.com/news/microsoft/microsofts-indexer-diagnostics-helps-troubleshoot-windows-search/

https://www.microsoft.com/en-us/p/indexer-diagnostics/9n25lzczwgs4?=&activetab=pivot:overviewtab

Sunday, March 1, 2020

One method to determine free disk space with ChromeOS

One method to determine free disk space within ChromeOS is to launch the Files app and click on the Downloads folder.  Click on the hamburger menu to the right, and the available disk space should be displayed at the bottom of the dialog box.


How to use the journalctl command to read and filter system log messages in Linux

With Linux versions that use systemd, all the system, boot, and kernel log files are collected and managed by a central, logging solution. The format the logs are stored in is binary.  To view this data, use the journalclt command.  To limit the number of entries returned, use the -n switch.

sudo journalctl -n 10


To display new entries as they are created, use the -f switch.

sudo journalctl -f

To view all data, use the -o verbose switch.

sudo journalctl -n 10 -o verbose

To see the log entries related to your last boot, use the -b switch.

journalctl -b


https://www.howtogeek.com/499623/how-to-use-journalctl-to-read-linux-system-logs/

WindowsFirewallRuleset

WindowsFirewallRuleset is a set of PowerShell scripts to modify Windows Firewall rules for various components.

https://github.com/metablaster/WindowsFirewallRuleset

https://www.kitploit.com/2020/01/windowsfirewallruleset-windows-firewall.html


Troubleshooter utility to "hide" updates or drivers within Windows 10

Windows 10 offers you the choice of when and how to get the latest updates to keep your device running smoothly and securely. In rare cases, a driver or update might cause issues with your PC. To keep the update from reinstalling automatically, use the utility below.

https://support.microsoft.com/en-us/help/4026726/windows-10-hide-updates-or-driver-updates

Draw.io

Draw.io is a web-based diagram web page.

https://about.draw.io/

GameSnacks

GameSnacks is a web site via Google that offers HTML 5-based games.

https://www.gamesnacks.com/

OWASP Amass

The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping, and  External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques.

https://www.darknet.org.uk/2020/02/owasp-amass-dns-enumeration-attack-surface-mapping-external-asset-discovery/

https://github.com/OWASP/Amass

Event Query Language (EQL)

The Event Query Language (EQL) is a standardized query language (similar to SQL) to evaluate Windows events.

https://pen-testing.sans.org/blog/2019/12/10/eql-threat-hunting

https://github.com/endgameinc/eqllib


Wednesday, February 5, 2020

How to determine the end of support value within ChromeOS

To determine when a device using ChromeOS is scheduled to lose support, access Settings.


Click on the hamburger menu icon and then select “About Chrome OS” at the bottom of the menu.
Click on “Additional Details”.
Under the “Update Schedule” section, the device’s end of support date should be displayed. 

etl2pcapng

The etl2pcapng utility allows a .etl packet capture file to be converted to a .pcapng format, which can be opened via Wireshark.

https://github.com/microsoft/etl2pcapng

CHAPS

CHAPS is a PowerShell script for checking system security settings where additional software and assessment tools, such as Microsoft Policy Analyzer, cannot be installed. The purpose of this script is to run it on a server or workstation to collect configuration information about that system. The information collected can then be used to provide recommendations (and references) to improve the security of the individual system and systemic issues within the organization's Windows environment.

https://www.kitploit.com/2020/01/chaps-configuration-hardening.html

https://github.com/cutaway-security/chaps


dSploit

dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities. It aims to offer to IT security experts the most complete and advanced professional toolkit to perform network security assessments on a mobile device.

https://www.darknet.org.uk/2020/01/dsploit-apk-download-hacking-security-toolkit-for-android/

https://github.com/Androguide/dsploit

PSADHealth

PSADHealth is a PowerShell module built to automate Active Directory health checks that should be done on a regular basis.

https://4sysops.com/archives/monitoring-active-directory-with-the-powershell-module-psadhealth/

https://github.com/compwiz32/PSADHealth

ONYPHE

ONYPHE is a search engine for open-source and cyber threat intelligence data collected by crawling various sources available on the Internet or by listening to Internet background noise. ONYPHE does correlate this information with data gathered by performing active Internet scanning for connected devices. It then normalizes information and makes it available via an API and its query language.

https://www.onyphe.io/

Wednesday, January 1, 2020

Keyboard shortcut to perform a Powerwash with ChromeOS

Below is a keyboard shortcut within ChromeOS to perform a Powerswash process.  Verify all accounts are logged out and use the combination below at the login screen.

CTRL+SHIFT+ALT+R



Disable auto-play videos within the Android Store App

To disable auto-play videos within the Android Store App, launch the app and access the hamburger menu near the top left corner of the screen.  Access the Settings menu selection.  Find the Auto-Play Videos selection, and then select the "Don't auto-play videos" option.


Examples of the ps command within Linux

Below are some examples of the ps command within Linux.

ps -eH --forest | less

This will list all processes (-e select all processes) and (-H hierarchy), as well as --forest includes ASCII lines.


The -f switch is for full-format and will include more columns.

ps -ef | less


The -u switch returns data for a particular user.

ps -u username | less

The -sort switch allows the information to be sorted by columns.

ps -e -o pcpu,args --sort -pcpu| less


Pipe through the head command to see the ten most CPU intensive processes.

ps -e -o pcpu,args --sort -pcpu | head -10


Microsoft Utility to assist with uninstalling an application or cleaning up afterwords

The Program Install and Uninstall troubleshooter helps you automatically repair issues when you're blocked from installing or removing programs. It also fixes corrupted registry keys.

https://support.microsoft.com/en-us/help/17588/windows-fix-problems-that-block-programs-being-installed-or-removed