pentest.ro

  • Permanent IP forwarding in Linux

    We usually do # echo 1 > /proc/sys/net/ipv4/ip_forward when we want to enable forwarding in Linux. If you want to make this change permanent, you need to edit the /etc/sysctl.conf file and add or uncomment the following line net.ipv4.ip_forward = 1

  • Password policies in Windows

    To access the password policy in Windows just go to Start and type in the search box secpol.msc. Click on secpol and you’ll be presented with the security policy. Go to Account Policies, then click on Password Policy. The options, explained: History – how many passwords will Windows store (you won’t be able to reuse…

  • OWASP Romania

    If you are an English speaker, well, this is a post announcing and promoting the Romanian Chapter of OWASP. You can join your local chapter or the global effort of OWASP to improve information security. ### OWASP (The Open Web Application Security Project) are acum deschisa o organizatie locala si in Romania. Suntem in cautare de noi…

  • Techniques to play with custom and encrypted protocols

    An interesting presentation from DEFCON20 provided by Elie Bursztein and Patrik Samy called “Fuzzing Online Games” touches areas of application security where traffic analysis is not enough to perform a penetration test. As stated by the authors: “In a nutshell the lack of direct access to the game server and having to deal with clients…

  • Webmin and Virtualmin installation on Debian

    Now that we have a fresh and clean Debian installation we can proceed to Webmin and Virtualmin installation. Althou installing Apache, MySQL and other stuff needed for a web server by hand is not hard and you can find a lot of support I prefer installing Webmin and Virtualmin to ease the administrative tasks. If…

  • Install a clean Debian on Virtualbox

    I don’t test my ‘ideas’ on live servers, nor do I keep unnecessary hardware around the house to play with them. So I use the other option in hand, a virtual machine. Despite the fact that this will be a VM installation of Debian, the idea for a very clean and basic installation is the…

  • Installing TCPDump on DD-WRT

    Now that we have JFFS enabled we can install new apps on our router. Note that the apps are installed into RAM and will vanish when you log out. You can write a script to automatically install your preferred applications during the log in process. DD-WRT does not come with a repository but we can…

  • Enabling JFFS in DD-WRT from SSH

    I like DD-WRT, it offers the basic tools needed for a router but I’d like to install other apps as well. The problem with embedded devices is that the system is installed in the non-volatile memory (usually 2-4MB) and one can only use the RAM to install apps. But first we need to map the…

  • Enabling DD-WRT web interface from SSH

    With this article we’re starting a new category regarding DD-WRT and micro-embedded devices. I’ve been using DD-WRT (and other variants as Open-WRT, Tomato, etc. depending on the device) for quite a while and every now and then I need to re-enable the web-interface from the command line. For instance I found the web-interface not responding…

  • ISO 27001 Domains, Control Objectives and Controls

    ISO 27001 has for the moment 11 Domains, 39 Control Objectives and 130+ Controls. Following is a list of the Domains and Control Objectives. 1. Security policy Information security policy Objective: To provide management direction and support for information security in accordance with business requirements and relevant laws and regulations. 2. Organization of information security…