This page includes a Java applet that probes network parameters such as DNS and available bandwidth.
Saturday, April 7, 2012
PAExec
PAExec lets you launch Windows programs on remote Windows computers without needing to install software on the remote computer first. For example, you could launch CMD.EXE remotely and have the equivalent of a terminal session to the remote server. PAExec is useful for doing remote installs, checking remote configuration, etc. It is similar to PsExec from Sysinternals.
Friday, April 6, 2012
Encryption Wizard
Encryption Wizard (EW) is a Java file and folder encryptor for protection of sensitive information. The Encryption Wizard encrypts all file types for data-at-rest and data-in-transit protection. Without installation or elevated privileges, EW runs on Windows, Mac, Linux, Solaris, and other computers with Sun Java. Behind its simple drag-n-drop interface, EW offers 128-bit AES encryption, SHA-256 hashing, searchable metadata, archives, compression, and secure deleting.
Sunday, April 1, 2012
Enhanced Protection Mode
Enhanced Protection Mode is a new feature within Windows 8. It is enabled by default with the Metro version of Internet Explorer 10, and can be enabled manually with the desktop version.
Enhanced Protection Mode offers some additional features compared to the original Protected Mode introduced with Vista. If the OS version and CPU support is available, all tabs processes are ran as 64-bit. This helps with technologies such as Address Space Layout Randomization. Enhanced Protection Mode restricts IE from locations that contain personal information until permission is granted. Tab processes (which is where untrusted Internet pages load) do not have access to a user’s domain credentials, as well as some other options such as tab processes cannot operate as local webservers.
The desktop version of IE 10 with Windows 8 will use 32-bit tab processes by default if Enhanced Protection Mode is not enabled. Metro IE uses EPM by default, so tab processes will be 64-bit with compatible hardware and operating system.
If a plug-in does not offer support with the desktop version of IE 10 when EPM is enabled, a notification bar should appear near the bottom of the screen.
Network Utilities with Ubuntu
Below are a few network-based utilities available with Ubuntu. The screen captures below are from Ubuntu version 10.04. The wget command allows HTTP access via a terminal prompt.
The tracepath command is similar to traceroute, but does not require root privileges. The command attempts to trace the “hops” to the destination specified.
The mtr command attempts to combine ping and tracepath. It shows the ping times for each “hop”.
The host command performs DNS lookups.
The dig command can be used for DNS lookups as well.
The whois command displays the whois records for the domain in question.
The ifplugstatus command will display if a network cable is plugged into an interface. It is not installed by default with Ubuntu, but the command sudo apt-get ifplugd should install it. The text “link beat detected” means a connection is present.
The ifconfig command will display information for all network interfaces, including IP addresses and MAC addresses.
The dhclient command will release and renew a DHCP lease. The –r parameter will release the current IP address.
The netstat command will display general information interface statistics. The –p parameter will display the programs associated with open sockets.
The command netstat –na | grep –i listen will display the network listening ports.
Log Parser Studio
Log Parser Studio is a utility that allows you to search through and create reports from your IIS, Event, EXADB and others types of logs. It builds on top of Log Parser 2.2 and has a full user interface for easy creation and management of related SQL queries.
http://gallery.technet.microsoft.com/Log-Parser-Studio-cd458765
Friday, March 9, 2012
Scapy
Scapy is an interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, etc. Additional details can be found at http://www.secdev.org/projects/scapy/. Below are some screen captures from Ubuntu version 10.04. Scapy was not present by default, so it needed to be installed.
The command must be executed with root credentials. Simply enter scapy, and the command prompt should appear.
The command ls() will display all of the various modules available.
To view options for a specific module such as TCP, enter the command ls(TCP).
Variables can be used to specify different values than the defaults. The command ls() can be used to verify the value of the variable.
The commands below configure the destination port, source port, and payload variables.
The command send(i/t/p) will send the packet to the destination address with the variables, which is the loopback in this example. The send command is at Layer 3; sendp is at Layer 2.
The tcpdump command can be used to verify the packet was sent.
Multiple ports can be used, as well as a range
The sr command can be used to send and receive data.
Thursday, March 8, 2012
Windows 8 Keyboard Shortcuts
Windows Key (tap)- Toggles between the Start screen and the foremost running app (Metro-style) or the Windows Desktop.
Windows Key + 1, Windows Key + 2, etc. - Switch to the (classic) Windows desktop and launch the nth shortcut in the Windows taskbar.
Windows Key + B - Switch to the Windows desktop and select the tray notification area.
Windows Key + C - Display Charms and time/date/notification overlay.
Windows Key + D - Switch to the Windows desktop and toggle Show Desktop.
Windows Key + E - Switch to the Windows desktop and launch Windows Explorer with Computer view displayed.
Windows Key + F - Display File Search pane
Windows Key + H - Display Share charm.
Windows Key + I - Display Settings charm.
Windows Key + J - Swaps foreground between the snapped and filled apps.
Windows Key + K - Display Devices charm.
Windows Key + L - Lock PC and return to Lock screen.
Windows Key + M - Minimize the selected Explorer window.
Windows Key + O - Toggle orientation switching on slate and tablet PCs.
Windows Key + P - Display the new Project (for "projection") pane for choosing between available displays.
Windows Key + Q - Search (within) Apps using the new Search pane.
Windows Key + R - Switch to the Windows desktop and display the Run box.
Windows Key + U - Switch to the Windows desktop and launch the Ease of Access Center.
Windows Key + V - Cycles through Notification toasts.
Windows Key + W - Display Settings Search pane
Windows Key + SHIFT + V - Cycles through Notification toasts in reverse order.
Windows Key + X - Access the advanced context menu on the Start preview tip.
Windows Key + Z - Access the App Bar.
Windows Key + ENTER - Launches Narrator.
Windows Key + SPACEBAR - Switch input language and keyboard layout
Windows Key + TAB - Cycle through apps in Switcher.
Windows Key + SHIFT + TAB - Cycle through apps in Switcher in reverse order.
Windows Key + CTRL + TAB - Cycle through apps, snapping them as you go.
Windows Key + PGUP - Moves the Start screen to the display on the left.
Windows Key + PGDN - Moves the Start screen to the display on the right.
Press "Windows Key + PrntScr" keys together and a screenshot will be automatically saved to "Pictures" library folder. The screenshot is saved with the name "Screenshot.png".
The new hotkey of "Shift+F8" replaces “F8” to boot into Safe Mode.
Tcpdump Information
Tcpdump is a command-line packet capture tool normally found within Unix/Linux operating systems. A Windows port can be found http://www.winpcap.org/windump/. Below are some common command switches for tcpdump.
-D = list available interfaces
-i = listen on the selected interface
-r = read the input file specified
-n = do not perform DNS resolution
-c = give a count of the number of records to process
-x = display data in hexadecimal
-e = display the MAC/Ethernet address information
-vv = verbose output
-X = display the ASCII payload of records
-w = write the data to a file
-q = quiet or quick output (less data)
‘tcp’ ‘ip’ ‘udp’ ‘icmp’ = macro filters for protocols
‘port’ = port filter
‘src port’ ‘dst port’ = source port and destination port filters
‘src host’ ‘dst host’ = source host and destination host filters
Below is an example of displaying the the available interfaces on an Ubuntu operating system, and then capturing traffic on one interface.
The example below reads a file called TEST, disables DNS and port resolution, and only display TCP traffic.
The example below reads a file called TEST, disables DNS and port resolution, and only display traffic using the port 23.
The command below continues the example but uses a filter to only include ICMP traffic and only where the destination host had the IP address of 192.0.2.1.
The example below uses a filter to include data with a source host of 192.0.2.1 or a destination port value of 23.
The verbose option will return additional details concerning the packets.
Wednesday, March 7, 2012
HTOP
The top command has been popular with Unix/Linux operating systems for some time. Htop is an different version of the original top command. Htop is not installed by default with some Linux distributions. With Ubuntu, use the following command to install the application.
sudo apt-get install htop
Once installed, simply type “htop” within a terminal prompt.
A series of function key shortcuts are listed at the bottom of the screen. A process can be selected by using the up and down arrows, and then the F9 key can be used to kill it.
The sort order can be modified by using the F6 key.
More information can be found at the project’s main web page at http://htop.sourceforge.net/.
https://www.howtogeek.com/how-to-use-linux-htop-command/
Subscribe to:
Posts (Atom)